# Ruby 1.8.6-p111 / 1.8.5-p114 released (Security Fix)

**URL:** <https://www.ruby-forum.com/t/ruby-1-8-6-p111-1-8-5-p114-released-security-fix/116293>\
**Category:** Ruby\
**Created:** [October 4, 2007, 6:38am UTC](https://www.ruby-forum.com/t/ruby-1-8-6-p111-1-8-5-p114-released-security-fix/116293 "2007-10-04T06:38:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\
**Post date:** [October 4, 2007, 6:38am UTC](https://www.ruby-forum.com/t/ruby-1-8-6-p111-1-8-5-p114-released-security-fix/116293/1 "2007-10-04T06:38:36Z")

</div>

Hi all.

A problem on the net/https library was reported. We already fixed that  
on the repository, but we also think it worth releasing. Here they are.  
The only difference with the latest 1.8.6-p110 / 1.8.5-p113 is the  
inclusion of fixes to it.

Detailed information should be found at the original advisory:  
[http://www.isecpartners.com/advisories/2007-006-rubyssl.txt](http://www.isecpartners.com/advisories/2007-006-rubyssl.txt)

Released tarballs are available at:

ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p111.tar.bz2  
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p111.tar.gz  
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p111.zip  
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p114.tar.bz2  
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p114.tar.gz  
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p114.zip

And checksums:

MD5(ruby-1.8.6-p111.tar.bz2)= e1d38b7d4f1be55726d6927a3395ce3b  
SHA256(ruby-1.8.6-p111.tar.bz2)=  
85c694678313818a5083bcfd66ae389fc053b506d93b5ad46f3764981c120fbb  
SIZE(ruby-1.8.6-p111.tar.bz2)= 3919396

MD5(ruby-1.8.6-p111.tar.gz)= c36e011733a3a3be6f43ba27b7cd7485  
SHA256(ruby-1.8.6-p111.tar.gz)=  
5edafdce60b28aecff1a10c892192b27f42ebdf4871018e86fc473366cc7dea6  
SIZE(ruby-1.8.6-p111.tar.gz)= 4547579

MD5(ruby-1.8.6-p111.zip)= 949974534a5ed3bc30adce6d4f8860e4  
SHA256(ruby-1.8.6-p111.zip)=  
1f61fe2625dde0e8be196c81247fbee2ecae2158939f21e233f0c2c5476ec4cb  
SIZE(ruby-1.8.6-p111.zip)= 5563270

MD5(ruby-1.8.5-p114.tar.bz2)= d57f9762b3b34a9e4835085b4c5acc59  
SHA256(ruby-1.8.5-p114.tar.bz2)=  
c503ae8eb47db72f78fb7a79fe1874ffef40a7094f7e803bacbf994a924244d9  
SIZE(ruby-1.8.5-p114.tar.bz2)= 3862713

MD5(ruby-1.8.5-p114.tar.gz)= 407204b3868991047b5c956aaebc4232  
SHA256(ruby-1.8.5-p114.tar.gz)=  
fea4f92e01b7e507a7485392255830afae0e60a8b5c1bec6eb8751078808a79a  
SIZE(ruby-1.8.5-p114.tar.gz)= 4484868

MD5(ruby-1.8.5-p114.zip)= 4a0e1810a19e25c6d91d538a8f0ecc60  
SHA256(ruby-1.8.5-p114.zip)=  
2c9bd43b310c164e9dfd529049dd67b1490e9ac5aca468bb4c296cd6d97d55ba  
SIZE(ruby-1.8.5-p114.zip)= 5493270

---

<div class="post-metadata">

**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\
**Post date:** [October 4, 2007, 3:36pm UTC](https://www.ruby-forum.com/t/ruby-1-8-6-p111-1-8-5-p114-released-security-fix/116293/2 "2007-10-04T15:36:06Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

Hi,

Urabe S. wrote:

> A problem on the net/https library was reported. We already fixed that  
> on the repository, but we also think it worth releasing. Here they are.  
> The only difference with the latest 1.8.6-p110 / 1.8.5-p113 is the  
> inclusion of fixes to it.
> 
> Detailed information should be found at the original advisory:  
> [http://www.isecpartners.com/advisories/2007-006-rubyssl.txt](http://www.isecpartners.com/advisories/2007-006-rubyssl.txt)

It’s not related to ruby but the report above should have a reference to  
RFC2818 3.1. Server Identity.

RFC2818 said:

Automated  
clients MUST log the error to an appropriate audit log (if available)  
and SHOULD terminate the connection (with a bad certificate error).

So net/http.rb versions on 1.8.6 and 1.8.5 SHOULD have  
@enable\_post\_connection\_check = true  
as well as a trunk version. I recommend turning it on as soon as  
possible although it’s your business, syouhei. Balance security and  
compatibility.

For users: the problem affects if;

1. code of your program or one of depending libraries is using  
net/https for SSL connection, plus,
2. the code sets http.verify\_mode to OpenSSL::SSL::VERIFY\_PEER  
explicitly (VERIFY\_NONE, which means no security, by default), plus,
3. the code sets http.ca\_file properly.

open-uri.rb is not affected on this because it does check server  
identity though it does 2 and 3. imap.rb, smtp.rb, pop.rb, drb/ssl.rb  
will be fixed soon.

Regards,  
// NaHi

-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.5 (Cygwin)

iQEVAwUBRwTrbB9L2jg5EEGlAQKrvggAwsB0AwpTuL0enc9UtUhLBhvKDIUwr6eu  
L5kAKxYn2CXH/r9AJY8F/fHT2jUeciIsnorkDwUIx+sHib2X2lo0XUWCqflusijb  
h1g7rSVVBlKEX3wvfgugWkbZjd17dFj3Z12D+oLxZHi2La0dwJdFe8UgQ1+POf6l  
iODrWKshN8d4olf9v++4LE49kUEnt/OGXMNMLENvwV3HnBGO8qtD/S85hjjIGZnV  
8JerSBziCffJGglE7+xozElfs23HZW4gBjoLCVanK0slEHzO0GmY94P6DGLO4VhW  
YCPP7M+1Nq+3fJPSXlT56SkcqyfWIcABpEKM+puUPD7dotFwqt8VXw==  
=nu+h  
-----END PGP SIGNATURE-----

---

<div class="post-metadata">

**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\
**Post date:** [November 8, 2007, 2:17pm UTC](https://www.ruby-forum.com/t/ruby-1-8-6-p111-1-8-5-p114-released-security-fix/116293/3 "2007-11-08T14:17:50Z")

</div>

BTW

The checksum is not mentioned on the Japanese download page. I guess I  
would notice a piece of Latin text on a Japanese page quite easily.

The release is not mentioned on the English download page at all.

The download pages do not mention the .bz2 version of the archive.

Thanks

Michal