openSUSE has issued an advisory today (June 27): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YUVA3VLO4OV257BQFK2XW3NHYOE2V7GX/ The issues are fixed upstream in 2.2.3.1: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30122.yml https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30123.yml Mageia 8 is also affected.
Status comment: (none) => Fixed upstream in 2.2.3.1Whiteboard: (none) => MGA8TOO
2.2.4 is currently building for cauldron and 2.2.3.1 for 8
ruby-rack-2.2.3.1-1.mga8 ruby-rack-doc-2.2.3.1-1.mga8 from ruby-rack-2.2.3.1-1.mga8.src.rpm
Whiteboard: MGA8TOO => (none)Assignee: pterjan => qa-bugsVersion: Cauldron => 8Status comment: Fixed upstream in 2.2.3.1 => (none)CC: (none) => pterjan
mga8, x64 Previous bug 26952. Installed the packages before update and tried a simple "HelloWorld" application. $ irb irb(main):001:0> require "rack" => true irb(main):002:0> require "thin" => true irb(main):003:0> irb(main):004:0> app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He llo World"] ] } => #<Proc:0x00000000021668e8 (irb):3 (lambda)> irb(main):005:0> irb(main):006:0> Rack::Handler::Thin.run app 2022-07-02 08:31:30 +0100 Thin web server (v1.8.1 codename Infinite Smoothie) 2022-07-02 08:31:30 +0100 Maximum connections set to 1024 2022-07-02 08:31:30 +0100 Listening on localhost:8080, CTRL+C to stop The "Hello World" message appeared in the browser at localhost:8080/ but there were complaints in the terminal about backends and eventmachine and this: RuntimeError (no acceptor (port is in use or requires root privileges)) Updated the packages and ran the HelloWorld script again. Message in the browser but no error reports in the terminal this time. $ irb irb(main):001:0> require 'rack' => true irb(main):002:0> require 'thin' => true irb(main):003:3" app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He irb(main):004:0> llo World"] ] } => #<Proc:0x00000000025b9f58 (irb):3 (lambda)> irb(main):005:0> However, using this script, from a previous bug: ------------------------------------------------------------------------------ #!/bin/env ruby require "rack" require "thin" app = -> ( env ) do sleep 3 [ 200, { "Content-Type" => "text/plain" }, ["Hello World\n"] ] end class LoggingMiddleware def initialize( app ) @app = app end def call( env ) before = Time.now.to_i status, headers, body = @app.call( env ) after = Time.now.to_i log_message = "App took #{after - before} seconds." [status, headers, body << log_message] end end Rack::Handler::Thin.run LoggingMiddleware.new( app ) ------------------------------------------------------------------------------ produces the same result but registers the runtime eoor seen before. Traceback (most recent call last): 9: from middle.rb:25:in `<main>' 8: from /usr/share/gems/gems/rack-2.2.3.1/lib/rack/handler/thin.rb:22:in `run' 7: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/server.rb:162:in `start' 6: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:75:in `start' 5: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run' 4: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run_machine' 3: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:65:in `block in start' 2: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/tcp_server.rb:16:in `connect' 1: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_server' /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_tcp_server': no acceptor (port is in use or requires root privileges) (RuntimeError) Giving this an OK because the HellowWorld side works fine. The error messages may be irrelevant.
Whiteboard: (none) => MGA8-64-OKCC: (none) => tarazed25
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0252.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED