* Cygwin64 v1.7.29: ruby 1.9.3p484 still vulnerable to Heartbleed bug
@ 2014-05-10 17:17 Robert Miesen
2014-05-11 6:07 ` Yaakov (Cygwin/X)
0 siblings, 1 reply; 2+ messages in thread
From: Robert Miesen @ 2014-05-10 17:17 UTC (permalink / raw)
To: cygwin
Hi everyone.
I recently installed the ruby package via Cygwin64 and, after running a
simple script, discovered that the version of ruby installed by Cygwin
also installs version 1.0.1f of the OpenSSL library, which is vulnerable
to the Heartbleed bug.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Cygwin64 v1.7.29: ruby 1.9.3p484 still vulnerable to Heartbleed bug
2014-05-10 17:17 Cygwin64 v1.7.29: ruby 1.9.3p484 still vulnerable to Heartbleed bug Robert Miesen
@ 2014-05-11 6:07 ` Yaakov (Cygwin/X)
0 siblings, 0 replies; 2+ messages in thread
From: Yaakov (Cygwin/X) @ 2014-05-11 6:07 UTC (permalink / raw)
To: cygwin
On 2014-05-10 12:17, Robert Miesen wrote:
> I recently installed the ruby package via Cygwin64 and, after running a
> simple script, discovered that the version of ruby installed by Cygwin
> also installs version 1.0.1f of the OpenSSL library, which is vulnerable
> to the Heartbleed bug.
Please don't spread misinformation. If you suspect an issue, *ask a
question* instead of making seemingly definitive statements.
I'm going to guess (since you didn't specify what your "simple script"
was) that you ran something like:
$ ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
OpenSSL 1.0.1f 6 Jan 2014
OPENSSL_VERSION is a compile-time constant[1]:
> OPENSSL_VERSION
> Version of OpenSSL the ruby OpenSSL extension was built with
IOW, all this tells you is that the (bundled) openssl extension was
compiled against 1.0.1f, which is true but irrelevant. What is relevant
is that it is dynamically linked against openssl:
$ /bin/ldd /usr/lib/ruby/1.9.1/x86_64-cygwin/openssl.so | grep -v
$(cygpath -W)
cygruby191.dll => /usr/bin/cygruby191.dll (0x4738c0000)
cygcrypt-0.dll => /usr/bin/cygcrypt-0.dll (0x442db0000)
cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)
cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3eed10000)
cygz.dll => /usr/bin/cygz.dll (0x3c0f60000)
cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3cb7d0000)
And therefore one simply needs to check the currently installed version
of openssl:
$ cygcheck -c libopenssl100
Cygwin Package Information
Package Version Status
libopenssl100 1.0.1g-1 OK
$ openssl version
OpenSSL 1.0.1g 7 Apr 2014
$ ruby -rfiddle -e 'puts
Fiddle::Function.new(DL.dlopen("cygcrypto-1.0.0.dll")["SSLeay_version"],[Fiddle::TYPE_INT],Fiddle::TYPE_VOIDP).call(0)'
OpenSSL 1.0.1g 7 Apr 2014
If your installation is current, these will be your results, and your
Cygwin installation is NOT vulnerable to CVE-2014-0160.
Yaakov
(Cygwin ruby maintainer)
[1]
http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL.html
(or install ruby-doc and run 'ri OpenSSL')
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-05-11 6:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-05-10 17:17 Cygwin64 v1.7.29: ruby 1.9.3p484 still vulnerable to Heartbleed bug Robert Miesen
2014-05-11 6:07 ` Yaakov (Cygwin/X)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).