@pawan-chawdhary Were you able to confirm that JRuby does indeed have this vulnerability? If so, can you show me how to do that?

Our 'openssl' implementation is based on BouncyCastle, but we use it in rather peculiar ways. Upgrading BC and releasing a new jruby-openssl seems like the most likely path forward, but I'd like to confirm we do actually have an issue first.

cc @kares @mkristian @enebo

according to https://robotattack.org/ this is fixed in BC with version 1.59 which is already out: https://bouncycastle.org/latest_releases.html

@mkristian Here's hoping they didn't break too much of the API this time 😝

since this is only under SSL/TLS jruby-openssl isn't effected.
for SSL we're relying on the JVM engine - HotSpot as well as IBM JVM have their own implementations.

at some point it would make a lot of sense to use BC's ssl engine but in currently released versions (all 0.9.x) we do not have the .jar included so this is not much not relevant for jossl. this would apply if you install the BC provider into the JDK, which is rarely done and if so it needs manual re-install anyways.

have double checked - as noted we do not consult BC for the SSLEngine in current released (0.9.x) versions]