Updated Knapsack package: OpenSSL 1.0.0m

209 views
Skip to first unread message

Luis Lavena

unread,
Jun 5, 2014, 10:05:14 PM6/5/14
to rubyin...@googlegroups.com
Hello,

Due recent disclosed vulnerabilities in OpenSSL [1], An updated version of this package is available:

x86-windows


  MD5: 1836409f45d3045243bb2653ad263f11

x64-windows


  MD5: b2d4582de8e763c8984d4498f3746496

---

If you're using Knapsack packages (headers and libraries), extract the contents as indicated in the original post [2.1][2.2]

If you're just using RubyInstaller, extract only the DLLS from the package (using 7-Zip) located in inside the bin folder.

I'm updating RubyInstaller recipes to use this version in the next few minutes, so newer versions of RubyInstaller ships with it.

Regards,


-- 
Luis Lavena
AREA 17
-
Perfection in design is achieved not when there is nothing more to add,
but rather when there is nothing more to take away.
Antoine de Saint-Exupéry

Serdar Sutay

unread,
Jun 9, 2014, 6:19:05 PM6/9/14
to rubyin...@googlegroups.com
Hrmmm maybe I spoke too soon Luis. Extracting libeay32.dll & ssleay32.dll into RubyInstaller I'm still getting 1.0.0k version in Ruby:

irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> OpenSSL::OPENSSL_VERSION
=> "OpenSSL 1.0.0k 5 Feb 2013"
irb(main):003:0>

I found an openssl.so file in RubyInstaller which also might need an update?

Thanks for the help... 

-- Serdar

Luis Lavena

unread,
Jun 9, 2014, 6:31:32 PM6/9/14
to rubyin...@googlegroups.com
On Mon, Jun 9, 2014 at 7:19 PM, Serdar Sutay <ser...@opscode.com> wrote:
Hrmmm maybe I spoke too soon Luis. Extracting libeay32.dll & ssleay32.dll into RubyInstaller I'm still getting 1.0.0k version in Ruby:

irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> OpenSSL::OPENSSL_VERSION
=> "OpenSSL 1.0.0k 5 Feb 2013"
irb(main):003:0>


The constant is defined at compilation time, not at runtime, that is why will report 1.0.0k, but the DLL being used is the one you extracted.

Because of that, Ruby is backporting some changes so next release can be verified *at runtime*:

 
I found an openssl.so file in RubyInstaller which also might need an update?


No need, openssl.so links dynamically against libeay32.dll and ssleay32.dll, so the fixes in OpenSSL dlls will be used by Ruby's OpenSSL extension.
 

--
You received this message because you are subscribed to the Google Groups "RubyInstaller" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rubyinstalle...@googlegroups.com.
To post to this group, send email to rubyin...@googlegroups.com.
Visit this group at http://groups.google.com/group/rubyinstaller.
For more options, visit https://groups.google.com/d/optout.

Serdar Sutay

unread,
Jun 9, 2014, 7:13:31 PM6/9/14
to rubyin...@googlegroups.com
Awesome... Thanks for the clarification Luis... 
Reply all
Reply to author
Forward
0 new messages