This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: Cygwin64 v1.7.29: ruby 1.9.3p484 still vulnerable to Heartbleed bug


On 2014-05-10 12:17, Robert Miesen wrote:
I recently installed the ruby package via Cygwin64 and, after running a
simple script, discovered that the version of ruby installed by Cygwin
also installs version 1.0.1f of the OpenSSL library, which is vulnerable
to the Heartbleed bug.

Please don't spread misinformation. If you suspect an issue, *ask a question* instead of making seemingly definitive statements.

I'm going to guess (since you didn't specify what your "simple script" was) that you ran something like:

$ ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
OpenSSL 1.0.1f 6 Jan 2014

OPENSSL_VERSION is a compile-time constant[1]:

OPENSSL_VERSION
Version of OpenSSL the ruby OpenSSL extension was built with

IOW, all this tells you is that the (bundled) openssl extension was compiled against 1.0.1f, which is true but irrelevant. What is relevant is that it is dynamically linked against openssl:

$ /bin/ldd /usr/lib/ruby/1.9.1/x86_64-cygwin/openssl.so | grep -v $(cygpath -W)
        cygruby191.dll => /usr/bin/cygruby191.dll (0x4738c0000)
        cygcrypt-0.dll => /usr/bin/cygcrypt-0.dll (0x442db0000)
        cygwin1.dll => /usr/bin/cygwin1.dll (0x180040000)
        cygcrypto-1.0.0.dll => /usr/bin/cygcrypto-1.0.0.dll (0x3eed10000)
        cygz.dll => /usr/bin/cygz.dll (0x3c0f60000)
        cygssl-1.0.0.dll => /usr/bin/cygssl-1.0.0.dll (0x3cb7d0000)

And therefore one simply needs to check the currently installed version of openssl:

$ cygcheck -c libopenssl100
Cygwin Package Information
Package              Version        Status
libopenssl100        1.0.1g-1       OK

$ openssl version
OpenSSL 1.0.1g 7 Apr 2014

$ ruby -rfiddle -e 'puts Fiddle::Function.new(DL.dlopen("cygcrypto-1.0.0.dll")["SSLeay_version"],[Fiddle::TYPE_INT],Fiddle::TYPE_VOIDP).call(0)'
OpenSSL 1.0.1g 7 Apr 2014

If your installation is current, these will be your results, and your Cygwin installation is NOT vulnerable to CVE-2014-0160.


Yaakov
(Cygwin ruby maintainer)

[1] http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL.html (or install ruby-doc and run 'ri OpenSSL')

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]