Re: Ruby / OpenSSL security issue

2016-09-30 Thread Ben Woodcroft
On 01/10/16 03:32, Leo Famulari wrote: On Wed, Sep 21, 2016 at 11:19:45AM +1000, Ben Woodcroft wrote: On 21/09/16 05:05, Leo Famulari wrote: On Tue, Sep 20, 2016 at 03:17:42PM +1000, Ben Woodcroft wrote: On 20/09/16 12:06, Leo Famulari wrote: Ruby users, There is a bug report on Ruby's Ope

Re: Ruby / OpenSSL security issue

2016-09-30 Thread Leo Famulari
On Wed, Sep 21, 2016 at 11:19:45AM +1000, Ben Woodcroft wrote: > On 21/09/16 05:05, Leo Famulari wrote: > > On Tue, Sep 20, 2016 at 03:17:42PM +1000, Ben Woodcroft wrote: > > > On 20/09/16 12:06, Leo Famulari wrote: > > > > Ruby users, > > > > > > > > There is a bug report on Ruby's OpenSSL module

Re: Ruby / OpenSSL security issue

2016-09-20 Thread Ben Woodcroft
On 21/09/16 05:05, Leo Famulari wrote: On Tue, Sep 20, 2016 at 03:17:42PM +1000, Ben Woodcroft wrote: On 20/09/16 12:06, Leo Famulari wrote: Ruby users, There is a bug report on Ruby's OpenSSL module regarding IV re-use in AES-GCM mode [0]. Does anyone volunteer to investigate the bug report

Re: Ruby / OpenSSL security issue

2016-09-20 Thread Leo Famulari
On Tue, Sep 20, 2016 at 03:17:42PM +1000, Ben Woodcroft wrote: > On 20/09/16 12:06, Leo Famulari wrote: > > Ruby users, > > > > There is a bug report on Ruby's OpenSSL module regarding IV re-use in > > AES-GCM mode [0]. > > > > Does anyone volunteer to investigate the bug report and decide what t

Re: Ruby / OpenSSL security issue

2016-09-19 Thread Ben Woodcroft
On 20/09/16 12:06, Leo Famulari wrote: Ruby users, There is a bug report on Ruby's OpenSSL module regarding IV re-use in AES-GCM mode [0]. Does anyone volunteer to investigate the bug report and decide what to do about it for our Ruby package? Thanks for the report Leo. I don't think much

Ruby / OpenSSL security issue

2016-09-19 Thread Leo Famulari
Ruby users, There is a bug report on Ruby's OpenSSL module regarding IV re-use in AES-GCM mode [0]. Does anyone volunteer to investigate the bug report and decide what to do about it for our Ruby package? [0] http://seclists.org/oss-sec/2016/q3/562 https://github.com/ruby/openssl/issues/49