[#113407] [Ruby master Feature#19630] [RFC] Deprecate `Kernel.open("|command-here")` due to frequent security issues — "postmodern (Hal Brodigan) via ruby-core" <ruby-core@...>

Issue #19630 has been reported by postmodern (Hal Brodigan).

19 messages 2023/05/05

[#113430] [Ruby master Feature#19633] Allow passing block to `Kernel#autoload` as alternative to second `filename` argument — "shioyama (Chris Salzberg) via ruby-core" <ruby-core@...>

Issue #19633 has been reported by shioyama (Chris Salzberg).

16 messages 2023/05/09

[#113489] [Ruby master Bug#19642] Remove vectored read/write from `io.c`. — "ioquatix (Samuel Williams) via ruby-core" <ruby-core@...>

Issue #19642 has been reported by ioquatix (Samuel Williams).

10 messages 2023/05/15

[#113498] [Ruby master Feature#19644] Module::current to complement Module::nesting — "bughit (bug hit) via ruby-core" <ruby-core@...>

Issue #19644 has been reported by bughit (bug hit).

12 messages 2023/05/16

[#113517] [Ruby master Misc#19679] Migrate Wiki from bugs.ruby-lang.org to ruby/ruby GitHub repository — "jemmai (Jemma Issroff) via ruby-core" <ruby-core@...>

Issue #19679 has been reported by jemmai (Jemma Issroff).

11 messages 2023/05/18

[#113529] [Ruby master Bug#19681] The final classpath of partially named modules is sometimes inconsistent once permanently named — "byroot (Jean Boussier) via ruby-core" <ruby-core@...>

Issue #19681 has been reported by byroot (Jean Boussier).

34 messages 2023/05/19

[#113538] [Ruby master Feature#19682] ability to get a reference to the "default definee" — "bughit (bug hit) via ruby-core" <ruby-core@...>

Issue #19682 has been reported by bughit (bug hit).

28 messages 2023/05/19

[#113601] [Ruby master Bug#19687] Should a development version of the standard library be included in ruby/ruby? — "jaruga (Jun Aruga) via ruby-core" <ruby-core@...>

Issue #19687 has been reported by jaruga (Jun Aruga).

9 messages 2023/05/23

[#113632] [Ruby master Bug#19691] Case insensitive file systems, require filename casing — "MSP-Greg (Greg L) via ruby-core" <ruby-core@...>

Issue #19691 has been reported by MSP-Greg (Greg L).

7 messages 2023/05/24

[#113656] [Ruby master Misc#19693] Data initialization is significantly slower than Struct — janosch-x via ruby-core <ruby-core@...>

Issue #19693 has been reported by janosch-x (Janosch M=FCller).

13 messages 2023/05/25

[#113660] [Ruby master Feature#19694] Add Regexp#timeout= setter — "aharpole (Aaron Harpole) via ruby-core" <ruby-core@...>

Issue #19694 has been reported by aharpole (Aaron Harpole).

15 messages 2023/05/25

[#113676] [Ruby master Bug#19697] Resolv::DNS resolution for international domains fails with "Encoding::CompatibilityError: incompatible character encodings: UTF-8 and ASCII-8BIT" — "clairity (claire c) via ruby-core" <ruby-core@...>

SXNzdWUgIzE5Njk3IGhhcyBiZWVuIHJlcG9ydGVkIGJ5IGNsYWlyaXR5IChjbGFpcmUgYykuDQ0K

6 messages 2023/05/27

[ruby-core:113414] [Ruby master Bug#19629] Fix for CVE-2023-28755 breaks "puppet apply" run

From: ManuelKiessling via ruby-core <ruby-core@...>
Date: 2023-05-06 07:47:16 UTC
List: ruby-core #113414
Issue #19629 has been updated by ManuelKiessling (Manuel Kie=DFling).





You are right, and they have already fixed it through https://bugs.launchpa=
d.net/ubuntu/+source/puppet/+bug/2018547.



----------------------------------------

Bug #19629: Fix for CVE-2023-28755 breaks "puppet apply" run

https://bugs.ruby-lang.org/issues/19629#change-102986



* Author: ManuelKiessling (Manuel Kie=DFling)

* Status: Third Party's Issue

* Priority: Normal

* ruby -v: ruby 2.7.0p0 (2019-12-25 revision 647ee6f091) [x86_64-linux-gnu]

* Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN

----------------------------------------

(Not neccessarily a bug in Ruby - chances are I should have formatted my Pu=
ppet file URIs differently from the get-go.)



However, since yesterday I'm getting these errors when running `puppet appl=
y`:



Could not evaluate: Could not retrieve file metadata for puppet:///modules/=
unattended_upgrades/etc/apt/apt.conf.d/50unattended-upgrades: Failed to ope=
n TCP connection to :8140 (Connection refused - connect(2) for "" port 8140)



I think the reason this happens now in an otherwise completely unchanged en=
vironment is that on my Ubuntu system, a new ruby2.7 package has been insta=
lled, due to CVE-2023-28755. See http://changelogs.ubuntu.com/changelogs/po=
ol/main/r/ruby2.7/ruby2.7_2.7.0-5ubuntu1.9/changelog for the backport info.



The patch info (URI.parse should set empty string in host instead of nil in=
 lib/uri/rfc3986_parser.rb, raise ArgumentError with empty host url again i=
n lib/net/http/generic_request.rb.) sounds exactly like the reason I'm sudd=
enly running into this error: `puppet:///modules/unattended_upgrades/etc/ap=
t/apt.conf.d/50unattended-upgrades` is an URI with an empty hostname - or i=
s it? It's actually meant to refer to a local file, not a file on remote ho=
st ""; however, this is how it now seems to be interpreted: protocol `puppe=
t`, hostname ``, path `/modules/unattended_upgrades...`.



Because the patched code now returns `""` for the hostname instead of `nil`=
, it tries to do a hostname lookup for `""` which of course fails.



Not sure if this is an intended consequence of the patch in this specific c=
ontext, which is why I'm reporting it.







--=20

https://bugs.ruby-lang.org/

 ______________________________________________
 ruby-core mailing list -- [email protected]
 To unsubscribe send an email to [email protected]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-c=
ore.ml.ruby-lang.org/

In This Thread

Prev Next