From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ben Woodcroft Subject: Re: Ruby / OpenSSL security issue Date: Wed, 21 Sep 2016 11:19:45 +1000 Message-ID: References: <20160920020636.GA17224@jasmine> <572d28c9-2d87-faa8-651e-cfd8698c3125@uq.edu.au> <20160920190502.GB16683@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:43979) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmWCf-0000l3-Bb for guix-devel@gnu.org; Tue, 20 Sep 2016 21:20:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bmWCb-00074i-5D for guix-devel@gnu.org; Tue, 20 Sep 2016 21:20:00 -0400 Received: from mailhub2.soe.uq.edu.au ([130.102.132.209]:34586 helo=newmailhub.uq.edu.au) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmWCa-00074G-I6 for guix-devel@gnu.org; Tue, 20 Sep 2016 21:19:57 -0400 In-Reply-To: <20160920190502.GB16683@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org On 21/09/16 05:05, Leo Famulari wrote: > On Tue, Sep 20, 2016 at 03:17:42PM +1000, Ben Woodcroft wrote: >> On 20/09/16 12:06, Leo Famulari wrote: >>> Ruby users, >>> >>> There is a bug report on Ruby's OpenSSL module regarding IV re-use in >>> AES-GCM mode [0]. >>> >>> Does anyone volunteer to investigate the bug report and decide what to >>> do about it for our Ruby package? >> Thanks for the report Leo. I don't think much can be done about this until >> a fix is released, no? It is unfortunately been around since March on that >> GitHub page, hopefully the report on oss-sec will spur some action. > Okay, do you volunteer to track this bug upstream? :) Sure, OK. ben