Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.rc > #342902 > unrolled thread

Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload

Back to article view | Back to linux.debian.bugs.rc

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Moritz Muehlenhoff <jmm@inutil.org> - 2023-06-07 11:20 +0200
    Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Kees Meijs | Nefos <keesm@nefos.nl> - 2023-06-07 11:30 +0200
    Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 13:00 +0200
      Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 15:40 +0200
        Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 23:30 +0200
          Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload "Chris Lamb" <lamby@debian.org> - 2023-06-08 02:10 +0200
      Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Bernhard Schmidt <berni@debian.org> - 2023-06-08 11:10 +0200

#342902 — Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload

On Wed, Jun 07, 2023 at 01:43:26PM +0530, Utkarsh Gupta wrote:
> Hi Chris,
> 
> On Wed, Jun 7, 2023 at 12:56 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Can you please have a look, as this seems to be caused by the DLA
> > issued as DLA-3447-1.
> 
> This has been caused by the ruby2.5 update.

It's definitely related to the fix for CVE-2023-28755, reverting that patch
unbreaks Puppet. I'd recommend to go ahead with a revert for now.

> Can you please TAL? This
> is perhaps because of the URI version in buster v/s URI version
> upstream. The upstream patch was supposed to be for 3.2 and was not
> 2.5 compliant. Let me know if you'd like me to help.

Specifically https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
states:

| For Ruby 2.7: Update to uri 0.10.0.1
| For Ruby 3.0: Update to uri 0.10.2
| For Ruby 3.1: Update to uri 0.11.1
| For Ruby 3.2: Update to uri 0.12.1

And the 0.10 change (https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70)
is different from the 0.12 one (https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175)

There might be other changes needed for 2.5, not sure.

Cheers,
        Moritz

[toc] | [next] | [standalone]

#342903

Hi there,

In our stack I see the exact same issue.

Cheers,
Kees

On 07-06-2023 11:09, Moritz Muehlenhoff wrote:
> It's definitely related to the fix for CVE-2023-28755, reverting that patch
> unbreaks Puppet. I'd recommend to go ahead with a revert for now.
>

[toc] | [prev] | [next] | [standalone]

#342904

Hiya,

On Wed, Jun 7, 2023 at 2:39 PM Moritz Muehlenhoff <jmm@inutil.org> wrote:
> Specifically https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
> states:
>
> | For Ruby 2.7: Update to uri 0.10.0.1
> | For Ruby 3.0: Update to uri 0.10.2
> | For Ruby 3.1: Update to uri 0.11.1
> | For Ruby 3.2: Update to uri 0.12.1
>
> And the 0.10 change (https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70)
> is different from the 0.12 one (https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175)
>
> There might be other changes needed for 2.5, not sure.

Yep, I'm taking a look to prep something for 2.5.


- u

[toc] | [prev] | [next] | [standalone]

#342907

Hi Kees,

On Wed, Jun 7, 2023 at 6:53 PM Kees Meijs | Nefos <keesm@nefos.nl> wrote:
> I know you were asking Bernhard, but I downloaded and installed as well.
> Our Puppet agent seems to be happy again.

I had missed your comment in the bug but super, many thanks for
testing this out! I'll wait a bit more before I roll this out.

There's also CVE-2021-33621 and CVE-2022-28739 open for ruby2.5 in
buster, I'll try to include the fixes in this update, too.


- u

[toc] | [prev] | [next] | [standalone]

#342910

Hi Chris,

On Wed, Jun 7, 2023 at 9:01 PM Chris Lamb <lamby@debian.org> wrote:
> I see your 2.5.5-3+deb10u6 update on the debian/buster branch which
> fixes the broken +deb10u5 upload, but I don't see it in the archive
> yet.
>
> Although you mentioned you were going to wait a bit more, I'm just
> 100%-checking you aren't waiting on anything from me to upload that?

Oh yeah, I wanted to sneak in some fixes and enable the tests and fix
the failing ones with the last upload. So I'll take care of the upload
and the announcement unless you prefer doing that since you did the
original upload?


- u

[toc] | [prev] | [next] | [standalone]

#342911

No, please go ahead and do both: my availability is spotty for the next 18 hours. :) 

(on mobile) 


Utkarsh Gupta wrote:

> Hi Chris,
>
> On Wed, Jun 7, 2023 at 9:01 PM Chris Lamb <lamby@debian.org> wrote:
>> I see your 2.5.5-3+deb10u6 update on the debian/buster branch which
>> fixes the broken +deb10u5 upload, but I don't see it in the archive
>> yet.
>>
>> Although you mentioned you were going to wait a bit more, I'm just
>> 100%-checking you aren't waiting on anything from me to upload that?
>
> Oh yeah, I wanted to sneak in some fixes and enable the tests and fix
> the failing ones with the last upload. So I'll take care of the upload
> and the announcement unless you prefer doing that since you did the
> original upload?
>
>
>

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

[toc] | [prev] | [next] | [standalone]

#342915

Hi Utkarsh,

> I've actually managed to prepare a final update that I'm ready to
> upload - this has quite some fixes plus 2 new CVE fixes. Would you
> please test the new resulting binaries and make sure they look sane
> enough? :)
> 
> The binaries can be found at
> https://people.debian.org/~utkarsh/lts/ruby2.5/. Many thanks!

I don't use ruby outside of puppet, but my puppet problem is fixed with 
these binaries. So from my POV you can release it.

Many thanks!
Bernhard

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.rc

csiph-web