3 ms·
Can anybody explain what exactly is happening? The PoC is really hard to read and understand.
by reedloden 13y ago
Can anybody explain what exactly is happening? The PoC is really hard to read and understand.
- steveklabnik 13y agoI don't fully get it either, but I think it has to do with what happens when you call PKey::RSA.to_pem: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKey/RSA.html#method-i-to_pem http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/P... I think that it'll calculate the private key, which you can then smuggle out to another file before you're supposed to be able to? The CVE number is just reserved at the time I'm posting this: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2734 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2734 Maybe in a few hours we'll have more information.