[ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks

Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack.

ruby-lang.org 16 Feb '12, 11am

[ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks

Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. In OpenSSL, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS option for SSL connection is used to prevent TLS-CBC-IV vulnerability described at [1] . It's known issue of TLSv1/SSLv3 but it attracts lots of attention these days as BEAST attack [2] (CVE-2011-3389). Ruby related topics are at our issue tracker [3] . Until now Ruby OpenSSL extension uses SSL_OP_ALL option, the combined option of OpenSSL for various bug workarounds that should be rather harmless, for all SSL connection by default. And it only allows users to add other options so you could not remove the feature that is included in SSL_OP_ALL option, like SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS . It was intentional as it didn't expose constants like SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS , but we should allow to unset the option so th...

Full article: http://www.ruby-lang.org/en/news/2012/02/16/security-fix-...

Tweets

» 16 Mar '12, 5am
ふもっ / “Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack.” [link]
@kimuraw » 17 Feb '12, 2pm
#macports #ruby port:ruby19 -> 1.9.3-p125. port:ruby->1.8.7-p358. see "Security Fix for Ruby OpenSSL module" [link]
@achilued » 16 Feb '12, 5pm
Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. [link]
@sora_h » 16 Feb '12, 3pm
訳している。英語難しい [link]
@jdcrackdon » 16 Feb '12, 2pm
RT @nahi: Can someone correct my English for the future releases? [link]
@nahi » 16 Feb '12, 2pm
Can someone correct my English for the future releases? [link]
@nahi » 16 Feb '12, 2pm
"Allow '0/n splitting' as a prevention for the TLS BEAST attack" 1.9.3-p125 and 1.8.7-p358. [link]
@f70r1 » 16 Feb '12, 11am
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@shyouhei » 16 Feb '12, 11am
[ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@devseo » 01 Mar '12, 6am
Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. - [link]
@ysekand » 27 Feb '12, 7pm
Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. [link]
@devseo » 22 Feb '12, 2pm
Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. - [link]
@devseo » 17 Feb '12, 11am
Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack. - [link]
@kjur » 16 Feb '12, 3pm
RT @nahi: "Allow '0/n splitting' as a prevention for the TLS BEAST attack" 1.9.3-p125 and 1.8.7-p358. [link]
@nahi » 16 Feb '12, 1pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@asip2k25 » 16 Feb '12, 1pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@andrerocker » 16 Feb '12, 1pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@_taca_ » 16 Feb '12, 12pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@AkitaOnRails » 16 Feb '12, 12pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]
@methodmissing » 16 Feb '12, 12pm
RT @shyouhei: [ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks [link]

Security Fix for Ruby OpenSSL module: Allow "0/n splitting" as a prevention for the TLS BEAST attack.

[ANN] #ruby 1.8.7 patchlevel 358 released, which adds a countermeasure for BEAST attacks

Tweets

Ruby 1.9.3-p125 and 1.8.7-p358 have been released

Sortie de Ruby 1.9.3-p125 suite à un correctif ...

Ruby 1.9.3-p125 をリリースした

Module: ActionView::Helpers::TextHelper:

New recommended Ruby version: Ruby 1.9.3-p125 i...

Sortie de Ruby 1.9.3-p125 suite à un correctif ...

A Unix Shell in Ruby