http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html

http://seclists.org/fulldisclosure/2014/Apr/231

http://seclists.org/fulldisclosure/2014/May/13

http://www.osvdb.org/106006

http://www.securityfocus.com/bid/66956

https://gist.github.com/10446549

https://gist.github.com/emboss/91696b56cd227c8a0c13

https://github.com/adrienthebo/cve-2014-2734/

https://news.ycombinator.com/item?id=7601973

https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/

MITRE disputed

** DISPUTED ** The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations.  NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code

The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations.  NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not 

** DISPUTADA ** La extensión openssl en Ruby 2.x no mantiene correctamente el estado de la memoria de procesos después de la reapertura de un fichero, lo que permite a atacantes remotos falsificar firmas dentro del contexto de una secuencia de comandos Ruby que intenta la verificación de firmas después de realizar cierta secuencia de operaciones del sistema de ficheros. NOTA: este problema ha sido disputado por el equipo OpenSSL de Ruby y terceras partes, que dicen qu

La extensión openssl en Ruby 2.x no mantiene debidamente el estado de memoria de proceso después de la reapertura de un archivo, lo que permite a atacantes remotos falsificar firmas dentro del contexto de un script Ruby que intenta verificación de firmas después de realizar cierta secuencia de operaciones del sistema de archivos.

https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/