From a3a62f87e144be31b9ca8ad6415b207f43f4e126 Mon Sep 17 00:00:00 2001 From: emboss Date: Fri, 5 Jul 2013 21:08:04 +0000 Subject: * lib/openssl/ssl.rb: Fix SSL client connection crash for SAN marked critical. The patch for CVE-2013-4073 caused SSL crash when a SSL server returns the certificate that has critical SAN value. X509 extension could include 2 or 3 elements in it: [id, criticality, octet_string] if critical, [id, octet_string] if not. Making sure to pick the last element of X509 extension and use it as SAN value. [ruby-core:55685] [Bug #8575] Thank you @nahi for providing the patch! git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@41805 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index d6fd2ca577..2cb8c11402 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,20 @@ +Sat Jul 6 06:06:16 2013 Martin Bosslet + + * lib/openssl/ssl.rb: Fix SSL client connection crash for SAN marked + critical. + The patch for CVE-2013-4073 caused SSL crash when a SSL server returns + the certificate that has critical SAN value. X509 extension could + include 2 or 3 elements in it: + + [id, criticality, octet_string] if critical, + [id, octet_string] if not. + + Making sure to pick the last element of X509 extension and use it as + SAN value. + [ruby-core:55685] [Bug #8575] + + Thank you @nahi for providing the patch! + Sat Jul 6 04:49:38 2013 Aaron Patterson * ext/psych/lib/psych/visitors/yaml_tree.rb: register time objects so -- cgit v1.2.3