mongo 2.21.2 → 2.21.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 581c10bfc119dd624b9c29d9471e7697ed7ece568cc7023c2a4894b9e430e58e
-  data.tar.gz: 634e8d69003d43838f47999e13d5677492cfd7ea396cec02907c17c734709024
+  metadata.gz: aa269cb6bbc5d94255ef1dfb56b4c963304437f9ddcc064b43545485a9892ffa
+  data.tar.gz: e0fe8f3cadadc8ef70a28d82ea512bd779d9380738bdb814d7d8c8f59618b65d
 SHA512:
-  metadata.gz: a58d9b653904b7c399be80f414551b00228b97078811e31c3d623ea924596510a39702c22e4830d166984326b8494d723f7e35cf6dfabbc8f06a0d30ff780c99
-  data.tar.gz: 11d1adcea0991ec8adca191c4015dc6914622e6bf5753046a8b0ad24cdf5de138329a702b522ba54d474dd03b18a983722827b112825b5602101e550cdd3754c
+  metadata.gz: 6819366f273f957c46eb5a9dae0a4de7cfe12f1bfea1fe60c412631650d0337d19e8f543d5608b04e8a2c7c57cb84ce3c5598ccaca0eec0984a8dddc9876c5d8
+  data.tar.gz: 2aebef8f8d12d6770b5e07cd516909d29762d76352518b7dfa79433d3eaf56fd9871086c8531e4dad21c70829bf268c7f834c2cf9f3bbbbf01fe787a803f2dc3

data/lib/mongo/socket/ssl.rb

@@ -23,6 +23,7 @@ module Mongo
     # @since 2.0.0
     class SSL < Socket
       include OpenSSL
+      include Loggable
 
       # Initializes a new TLS socket.
       #
@@ -455,12 +456,15 @@ module Mongo
       end
 
       def verify_ocsp_endpoint!(socket, timeout = nil)
-        unless verify_ocsp_endpoint?
-          return
-        end
+        return unless verify_ocsp_endpoint?
 
         cert = socket.peer_cert
-        ca_cert = socket.peer_cert_chain.last
+        ca_cert = find_issuer(cert, socket.peer_cert_chain)
+
+        unless ca_cert
+          log_warn("TLS certificate of '#{host_name}' could not be definitively verified via OCSP: issuer certificate not found in the chain.")
+          return
+        end
 
         verifier = OcspVerifier.new(@host_name, cert, ca_cert, context.cert_store,
           **Utils.shallow_symbolize_keys(options).merge(timeout: timeout))
@@ -503,6 +507,11 @@ module Mongo
           end
         end
       end
+
+      # Find the issuer certificate in the chain.
+      def find_issuer(cert, cert_chain)
+        cert_chain.find { |c| c.subject == cert.issuer }
+      end
     end
   end
 end

data/lib/mongo/version.rb

@@ -5,5 +5,5 @@ module Mongo
   #
   # Note that this file is automatically updated via `rake candidate:create`.
   # Manual changes to this file will be overwritten by that rake task.
-  VERSION = '2.21.2'
+  VERSION = '2.21.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mongo
 version: !ruby/object:Gem::Version
-  version: 2.21.2
+  version: 2.21.3
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -553,7 +553,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.1
 specification_version: 4
 summary: Ruby driver for MongoDB
 test_files: []