Bug #8750
closed
unit test fix for CVE-2013-4073 seems to be incomplete
Added by terceiro (Antonio Terceiro) over 10 years ago.
Updated over 10 years ago.
Description
Hello, I was just testing some Ruby versions against vulnerability against Hostname check bypassing vulnerability in SSL client (CVE-2013-4073), and it looks like the unit test added together with the fix for that issue passes even without that patch applied.
I noticed that the tampered input is using single quotes, as in
'www.example.com\0.evil.com'
I could only make those tests fail when I switched the single quotes into single quotes. This should probably apply to 1.9.3 andn 2.0.0 as well.
Files
This should fix the issue.
- Status changed from Open to Closed
- % Done changed from 0 to 100
This issue was solved with changeset r42429.
Antonio, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.
- test/openssl/test_ssl.rb: Fix test for CVE-2013-4073.
Patch by Antonio Terceiro. [Bug #8750] [ruby-core:56437]
- Backport changed from 1.9.3: UNKNOWN, 2.0.0: UNKNOWN to 1.9.3: REQUIRED, 2.0.0: REQUIRED
- Backport changed from 1.9.3: REQUIRED, 2.0.0: REQUIRED to 1.9.3: REQUIRED, 2.0.0: DONE
Backported to ruby_2_0_0 branch at r42588.
- Backport changed from 1.9.3: REQUIRED, 2.0.0: DONE to 1.9.3: DONE, 2.0.0: DONE
backported to ruby_1_9_3 at r42622.
Also available in: Atom
PDF
Like0
Like0Like0Like0Like0Like0