# Jruby-openssl 0.6 - Recommended Upgrade

**URL:** <https://www.ruby-forum.com/t/jruby-openssl-0-6-recommended-upgrade/179894>\
**Category:** Ruby\
**Created:** [December 7, 2009, 3:40pm UTC](https://www.ruby-forum.com/t/jruby-openssl-0-6-recommended-upgrade/179894 "2009-12-07T15:40:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicksnels](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/aca169/32.png) [@nicksnels](https://www.ruby-forum.com/u/nicksnels)\
**Post date:** [December 7, 2009, 3:40pm UTC](https://www.ruby-forum.com/t/jruby-openssl-0-6-recommended-upgrade/179894/1 "2009-12-07T15:40:24Z")

</div>

I’ve just released jruby-openssl 0.6. jruby-openssl is an add-on gem  
that implements Ruby’s OpenSSL extension for JRuby.

PLEASE NOTE: this is a recommended upgrade. A security vulnerability  
was discovered in jruby-openssl versions 0.5.2 and earlier. This  
vulnerability only applies if you’re using JRuby and the jruby-openssl  
library.

The security problem involves peer certificate verification where  
failed verification silently did nothing, making affected applications  
vulnerable to attackers. Attackers could lead a client application to  
believe that a secure connection to a rogue SSL server is legitimate.  
Attackers could also penetrate client-validated SSL server  
applications with a dummy certificate. Your application might be  
vulnerable if you’re using any of these versions of jruby-openssl  
along with the OpenSSL::SSL::VERIFY\_PEER mode on the SSL socket.  
Please see the full disclosure below [1](http://www.jruby.org/2009/12/07/vulnerability-in-jruby-openssl.html) to determine if your  
application is affected. If you have any questions, please send email  
to removed\_email\_address@domain.invalid, a private email address.

The Common Vulnerabilities and Exposures (CVE) project has assigned  
the name CVE-2009-4123 to this issue. This is a candidate for  
inclusion in the CVE list ([http://cve.mitre.org](http://cve.mitre.org)), which standardizes  
names for security problems.

Thanks to NaHi (NAKAMURA Hiroshi) for finding the problem and  
providing the fix.

/Nick

Changelog:

- Many fixes from NaHi, including issues related to certificate  
verification and certificate store purpose verification.
  - implement OpenSSL::X509::Store#set\_default\_paths
  - MRI compat. fix: OpenSSL::X509::Store#add\_file
  - Fix nsCertType handling.
  - Fix Cipher#key\_len for DES-EDE3: 16 should be 24.
  - Modified test expectations around Cipher#final.

- Public keys are lazily instantiated when the  
X509::Certificate#public\_key method is called (Dave Garcia)