Bug 16220 - ruby-rack new security issue CVE-2015-3225
Summary: ruby-rack new security issue CVE-2015-3225
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/649531/
Whiteboard: MGA4TOO advisory MGA4-32-OK MGA4-64-O...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-06-26 18:38 CEST by David Walser
Modified: 2015-09-08 19:57 CEST (History)
4 users (show)

See Also:
Source RPM: ruby-rack-1.5.2-7.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-06-26 18:38:02 CEST
A security issue fixed upstream in Rack was announced on June 16:
http://www.openwall.com/lists/oss-security/2015/06/16/14

The issue is fixed in version 1.5.4 and the patches are included in the message above.

Mageia 4 and Mageia 5 are also affected.

Reproducible: 

Steps to Reproduce:
David Walser 2015-06-26 18:38:11 CEST

CC: (none) => fundawang
Whiteboard: (none) => MGA5TOO, MGA4TOO

Comment 1 Sander Lepik 2015-08-23 16:30:37 CEST
If there is no progress in one week then the following packages will be dropped as they depend on ruby-rack:

ruby-capybara
ruby-cucumber-rails
ruby-github_api
ruby-oauth2
ruby-omniauth
ruby-rack
ruby-rack-cache
ruby-rack-openid
ruby-rack-protection
ruby-rack-ssl
ruby-rack-test
ruby-shotgun
ruby-sinatra
ruby-sprockets
ruby-thin
ruby-unicorn
ruby-yard

CC: (none) => mageia

Comment 2 Sander Lepik 2015-08-30 19:31:22 CEST
Dropped from cauldron.

Hardware: i586 => All
Version: Cauldron => 5
Whiteboard: MGA5TOO, MGA4TOO => MGA4TOO

David Walser 2015-09-02 18:41:28 CEST

Severity: normal => major

Comment 3 David Walser 2015-09-03 15:57:35 CEST
I synced this commit in Fedora to fix it:
http://pkgs.fedoraproject.org/cgit/rubygem-rack.git/commit/?h=f21&id=5586d9219ad447151662fbd2203fc674dfafd232

Advisory:
========================

Updated ruby-rack packages fix security vulnerability:

lib/rack/utils.rb in Rack before 1.5.4 allows remote attackers to cause a
denial of service (SystemStackError) via a request with a large parameter
depth (CVE-2015-3225).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3225
https://lists.fedoraproject.org/pipermail/package-announce/2015-August/165180.html
========================

Updated packages in core/updates_testing:
========================
ruby-rack-1.5.2-5.1.mga4
ruby-rack-doc-1.5.2-5.1.mga4
ruby-rack-1.5.2-7.1.mga5
ruby-rack-doc-1.5.2-7.1.mga5

from SRPMS:
ruby-rack-1.5.2-5.1.mga4.src.rpm
ruby-rack-1.5.2-7.1.mga5.src.rpm

Assignee: pterjan => qa-bugs

Comment 4 Samuel Verschelde 2015-09-03 17:40:20 CEST
Does this mean it can be undropped from cauldron, or is the fact that we couldn't secure it in a timely manner still means we can't support it?
Comment 5 David Walser 2015-09-03 17:50:00 CEST
If someone actually plans to maintain it and wants to bring it back, that's fine.  Otherwise it won't be brought back unless it's needed for some reason.  My interpretation after doing this update is that this package should have been dropped before Mageia 5, when ruby on rails was dropped, but I just missed it.
Comment 6 William Kenney 2015-09-03 18:43:57 CEST
(In reply to David Walser from comment #5)

> If someone actually plans to maintain it and wants to bring it back, that's
> fine.  Otherwise it won't be brought back unless it's needed for some
> reason.  My interpretation after doing this update is that this package
> should have been dropped before Mageia 5, when ruby on rails was dropped,
> but I just missed it.

Should this then be just test for successful install then ensure
a successful update?

CC: (none) => wilcal.int

Comment 7 David Walser 2015-09-03 18:48:01 CEST
(In reply to William Kenney from comment #6)
> Should this then be just test for successful install then ensure
> a successful update?

That's a yes for this and most of the current update candidates.
Comment 8 William Kenney 2015-09-03 19:46:53 CEST
(In reply to David Walser from comment #7)

> That's a yes for this and most of the current update candidates.

Lets tag which ones those are at todays QA meeting.
Comment 9 William Kenney 2015-09-05 18:21:50 CEST
In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
ruby-rack

default install of ruby-rack

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-5.mga4.noarch is already installed

ruby-rack installs cleanly.

install ruby-rack from updates_testing

For some reason neither the MCC nor urpmi ( urpmi ruby-rack )
sees the ruby-rack-1.5.2-5.1.mga4 package in the updates_testing
repo. Even though it's there.
Comment 10 William Kenney 2015-09-05 18:37:35 CEST
In VirtualBox, M4, KDE, 32-bit

change to mirrors.kernel.org repo

Package(s) under test:
ruby-rack

default install of ruby-rack

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-5.mga4.noarch is already installed

ruby-rack installs cleanly.

install ruby-rack from updates_testing

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-5.1.mga4.noarch is already installed

ruby-rack updates cleanly
William Kenney 2015-09-05 18:37:53 CEST

Whiteboard: MGA4TOO => MGA4TOO MGA4-32-OK

Comment 11 William Kenney 2015-09-05 18:50:54 CEST
In VirtualBox, M4, KDE, 64-bit

change to mirrors.kernel.org repo

Package(s) under test:
ruby-rack ruby-rack-doc

default install of ruby-rack ruby-rack-doc

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-5.mga4.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-5.mga4.noarch is already installed

ruby-rack installs cleanly.

install ruby-rack from updates_testing

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-5.1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-5.1.mga4.noarch is already installed

ruby-rack & ruby-rack-doc updates cleanly

Whiteboard: MGA4TOO MGA4-32-OK => MGA4TOO MGA4-32-OK MGA4-64-OK

Comment 12 William Kenney 2015-09-05 19:01:08 CEST
In VirtualBox, M5, KDE, 32-bit

Package(s) under test:
ruby-rack ruby-rack-doc

default install of ruby-rack &  ruby-rack-doc

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-7.mga5.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-7.mga5.noarch is already installed

ruby-rack &  ruby-rack-doc install cleanly.

install ruby-rack & ruby-rack-doc from updates_testing

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-7.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-7.1.mga5.noarch is already installed

ruby-rack & ruby-rack-doc update cleanly

Whiteboard: MGA4TOO MGA4-32-OK MGA4-64-OK => MGA4TOO MGA4-32-OK MGA4-64-OK MGA5-32-OK

Comment 13 William Kenney 2015-09-05 19:21:53 CEST
In VirtualBox, M5, KDE, 64-bit

Package(s) under test:
ruby-rack ruby-rack-doc

default install of ruby-rack &  ruby-rack-doc

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-7.mga5.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-7.mga5.noarch is already installed

ruby-rack &  ruby-rack-doc install cleanly.

install ruby-rack & ruby-rack-doc from updates_testing

[root@localhost wilcal]# urpmi ruby-rack
Package ruby-rack-1.5.2-7.1.mga5.noarch is already installed
[root@localhost wilcal]# urpmi ruby-rack-doc
Package ruby-rack-doc-1.5.2-7.1.mga5.noarch is already installed

ruby-rack & ruby-rack-doc update cleanly

Whiteboard: MGA4TOO MGA4-32-OK MGA4-64-OK MGA5-32-OK => MGA4TOO MGA4-32-OK MGA4-64-OK MGA5-32-OK MGA5-64-OK

Comment 14 William Kenney 2015-09-05 19:22:41 CEST
This bug updates cleanly.
Testing complete for MGA4 & MGA5, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 15 claire robinson 2015-09-08 15:10:18 CEST
Advisory uploaded.

Whiteboard: MGA4TOO MGA4-32-OK MGA4-64-OK MGA5-32-OK MGA5-64-OK => MGA4TOO advisory MGA4-32-OK MGA4-64-OK MGA5-32-OK MGA5-64-OK

Comment 16 Mageia Robot 2015-09-08 19:57:26 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0346.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.