ruby/ruby — pull request #591 by PiPeep (2014-04-10 23:59:08+00:00)
Title: Make `SSL_SESSION_cmp` use `CRYPTO_memcmp`

There could be potential issues with leaking session ids between clients, using a timing attack. This patch doesn't guarantee constant time for `SSL_SESSION_cmp`, but at least makes it constant time if the `ssl_version` and `session_id_length` are equal, which would make certain types of attacks more difficult.

For example, if one was attempting to determine the number of active SSL sessions on a server, this would largely thwart such an attacker.

To be clear: I do not believe this is a significant security issue, but rather a place where we might be able to more closely match a developer's expectations of the function.

For reference, see:
- http://seclists.org/fulldisclosure/2014/Apr/117
- https://news.ycombinator.com/item?id=7570043