| Summary: | ruby-rack new security issues CVE-2022-30122 and CVE-2022-30123 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, pterjan, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | ruby-rack-2.2.3-2.mga9.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2022-06-27 23:39:01 CEST
David Walser
2022-06-27 23:39:17 CEST
Status comment:
(none) =>
Fixed upstream in 2.2.3.1 2.2.4 is currently building for cauldron and 2.2.3.1 for 8 ruby-rack-2.2.3.1-1.mga8 ruby-rack-doc-2.2.3.1-1.mga8 from ruby-rack-2.2.3.1-1.mga8.src.rpm Whiteboard:
MGA8TOO =>
(none) mga8, x64 Previous bug 26952. Installed the packages before update and tried a simple "HelloWorld" application. $ irb irb(main):001:0> require "rack" => true irb(main):002:0> require "thin" => true irb(main):003:0> irb(main):004:0> app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He llo World"] ] } => #<Proc:0x00000000021668e8 (irb):3 (lambda)> irb(main):005:0> irb(main):006:0> Rack::Handler::Thin.run app 2022-07-02 08:31:30 +0100 Thin web server (v1.8.1 codename Infinite Smoothie) 2022-07-02 08:31:30 +0100 Maximum connections set to 1024 2022-07-02 08:31:30 +0100 Listening on localhost:8080, CTRL+C to stop The "Hello World" message appeared in the browser at localhost:8080/ but there were complaints in the terminal about backends and eventmachine and this: RuntimeError (no acceptor (port is in use or requires root privileges)) Updated the packages and ran the HelloWorld script again. Message in the browser but no error reports in the terminal this time. $ irb irb(main):001:0> require 'rack' => true irb(main):002:0> require 'thin' => true irb(main):003:3" app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He irb(main):004:0> llo World"] ] } => #<Proc:0x00000000025b9f58 (irb):3 (lambda)> irb(main):005:0> However, using this script, from a previous bug: ------------------------------------------------------------------------------ #!/bin/env ruby require "rack" require "thin" app = -> ( env ) do sleep 3 [ 200, { "Content-Type" => "text/plain" }, ["Hello World\n"] ] end class LoggingMiddleware def initialize( app ) @app = app end def call( env ) before = Time.now.to_i status, headers, body = @app.call( env ) after = Time.now.to_i log_message = "App took #{after - before} seconds." [status, headers, body << log_message] end end Rack::Handler::Thin.run LoggingMiddleware.new( app ) ------------------------------------------------------------------------------ produces the same result but registers the runtime eoor seen before. Traceback (most recent call last): 9: from middle.rb:25:in `<main>' 8: from /usr/share/gems/gems/rack-2.2.3.1/lib/rack/handler/thin.rb:22:in `run' 7: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/server.rb:162:in `start' 6: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:75:in `start' 5: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run' 4: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run_machine' 3: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:65:in `block in start' 2: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/tcp_server.rb:16:in `connect' 1: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_server' /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_tcp_server': no acceptor (port is in use or requires root privileges) (RuntimeError) Giving this an OK because the HellowWorld side works fine. The error messages may be irrelevant. Whiteboard:
(none) =>
MGA8-64-OK Validating. Keywords:
(none) =>
validated_update
Dave Hodgins
2022-07-04 23:42:33 CEST
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0252.html Resolution:
(none) =>
FIXED |