Backport #8582

Fix warning in ssl.rb

Added by Santiago Pastorino 10 months ago. Updated 10 months ago.

[ruby-core:55707]
Status:Closed
Priority:Normal
Assignee:Tomoyuki Chikanaga

Description

This is a fix for "warning: assigned but unused variable - id" in ssl.rb

https://github.com/ruby/ruby/pull/348

Associated revisions

Revision 41812
Added by Tomoyuki Chikanaga 10 months ago

merge revision(s) 41805: [Backport #8575] [Backport #8582]

* lib/openssl/ssl.rb: Fix SSL client connection crash for SAN marked
  critical.
  The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
  the certificate that has critical SAN value.  X509 extension could
  include 2 or 3 elements in it:
  [id, criticality, octet_string] if critical,
  [id, octet_string] if not.
  Making sure to pick the last element of X509 extension and use it as
  SAN value.
   [Bug #8575]
  Thank you @nahi for providing the patch!

History

#1 Updated by Martin Bosslet 10 months ago

  • Category set to ext/openssl
  • Assignee set to Martin Bosslet
  • Target version set to 2.1.0

Thanks, Santiago!

#2 Updated by Rafael França 10 months ago

Would be great if this is released in the next 2.0.0 patch level.

#3 Updated by Martin Bosslet 10 months ago

  • Status changed from Open to Closed

Implicitly resolved by r41805 from #8575.

#4 Updated by Tomoyuki Chikanaga 10 months ago

  • Tracker changed from misc to Backport
  • Project changed from ruby-trunk to Backport200
  • Category deleted (ext/openssl)
  • Status changed from Closed to Assigned
  • Assignee changed from Martin Bosslet to Tomoyuki Chikanaga
  • Target version deleted (2.1.0)

#5 Updated by Tomoyuki Chikanaga 10 months ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

This issue was solved with changeset r41812.
Santiago, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.


merge revision(s) 41805: [Backport #8575] [Backport #8582]

* lib/openssl/ssl.rb: Fix SSL client connection crash for SAN marked
  critical.
  The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
  the certificate that has critical SAN value.  X509 extension could
  include 2 or 3 elements in it:
  [id, criticality, octet_string] if critical,
  [id, octet_string] if not.
  Making sure to pick the last element of X509 extension and use it as
  SAN value.
   [Bug #8575]
  Thank you @nahi for providing the patch!

Also available in: Atom PDF