Hi,

The context is we use JRuby-Openssl in our code, then we use Sonar to scan our code and found lots(hundreds) of 'Using Components with Known Vulnerabilities' alerts which are about OpenSSL.
e.g:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4252
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8176
....
These alerts are about OpenSSL, so I tried to find whether JRuby-OpenSSL uses OpenSSL or it's just ruby version of openssl?

If you use openssl, do you have OpenSSL version info I can refer?
And if jruby-openssl is pure ruby/java version, will you consider above alerts also apply to jruby-openssl?

Thanks,
Ivan Geng

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.