Bug 30584 - ruby-rack new security issues CVE-2022-30122 and CVE-2022-30123
Summary: ruby-rack new security issues CVE-2022-30122 and CVE-2022-30123
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-06-27 23:39 CEST by David Walser
Modified: 2022-07-05 21:12 CEST (History)
5 users (show)

See Also:
Source RPM: ruby-rack-2.2.3-2.mga9.src.rpm
CVE:
Status comment:


Attachments

David Walser 2022-06-27 23:39:17 CEST

Status comment: (none) => Fixed upstream in 2.2.3.1
Whiteboard: (none) => MGA8TOO

Comment 1 Pascal Terjan 2022-07-01 18:22:42 CEST
2.2.4 is currently building for cauldron and 2.2.3.1 for 8
Comment 2 David Walser 2022-07-01 18:31:36 CEST
ruby-rack-2.2.3.1-1.mga8
ruby-rack-doc-2.2.3.1-1.mga8

from ruby-rack-2.2.3.1-1.mga8.src.rpm

Whiteboard: MGA8TOO => (none)
Assignee: pterjan => qa-bugs
Version: Cauldron => 8
Status comment: Fixed upstream in 2.2.3.1 => (none)
CC: (none) => pterjan

Comment 3 Len Lawrence 2022-07-02 10:16:00 CEST
mga8, x64
Previous bug 26952.

Installed the packages before update and tried a simple "HelloWorld" application.
$ irb
irb(main):001:0> require "rack"
=> true
irb(main):002:0> require "thin"
=> true
irb(main):003:0> 
irb(main):004:0> app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He
llo World"] ] }
=> #<Proc:0x00000000021668e8 (irb):3 (lambda)>
irb(main):005:0> 
irb(main):006:0> Rack::Handler::Thin.run app
2022-07-02 08:31:30 +0100 Thin web server (v1.8.1 codename Infinite Smoothie)
2022-07-02 08:31:30 +0100 Maximum connections set to 1024
2022-07-02 08:31:30 +0100 Listening on localhost:8080, CTRL+C to stop

The "Hello World" message appeared in the browser at localhost:8080/
but there were complaints in the terminal about backends and eventmachine and this:
RuntimeError (no acceptor (port is in use or requires root privileges))

Updated the packages and ran the HelloWorld script again.  Message in the browser but no error reports in the terminal this time.
$ irb
irb(main):001:0> require 'rack'
=> true
irb(main):002:0> require 'thin'
=> true
irb(main):003:3" app = ->( env ) { [ 200, {"Content-Type" => "text/plain"}, ["He

irb(main):004:0>       llo World"] ] }
=> #<Proc:0x00000000025b9f58 (irb):3 (lambda)>
irb(main):005:0> 

However, using this script, from a previous bug:
------------------------------------------------------------------------------
#!/bin/env ruby
require "rack"
require "thin"

app = -> ( env ) do
  sleep 3
  [ 200, { "Content-Type" => "text/plain" }, ["Hello World\n"] ]
end

class LoggingMiddleware
  def initialize( app )
    @app = app
  end

  def call( env )
    before = Time.now.to_i
    status, headers, body = @app.call( env )
    after = Time.now.to_i
    log_message = "App took #{after - before} seconds."

    [status, headers, body << log_message]
  end
end

Rack::Handler::Thin.run LoggingMiddleware.new( app )
------------------------------------------------------------------------------

produces the same result but registers the runtime eoor seen before.
Traceback (most recent call last):
	9: from middle.rb:25:in `<main>'
	8: from /usr/share/gems/gems/rack-2.2.3.1/lib/rack/handler/thin.rb:22:in `run'
	7: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/server.rb:162:in `start'
	6: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:75:in `start'
	5: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run'
	4: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:195:in `run_machine'
	3: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/base.rb:65:in `block in start'
	2: from /usr/local/share/gems/gems/thin-1.8.1/lib/thin/backends/tcp_server.rb:16:in `connect'
	1: from /usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_server'
/usr/local/share/gems/gems/eventmachine-1.2.7/lib/eventmachine.rb:531:in `start_tcp_server': no acceptor (port is in use or requires root privileges) (RuntimeError)

Giving this an OK because the HellowWorld side works fine.  The error messages may be irrelevant.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Comment 4 Thomas Andrews 2022-07-03 04:50:16 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2022-07-04 23:42:33 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2022-07-05 21:12:44 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0252.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.