Bug 1366480
| Summary: | CVE-2016-6316 rubygem-actionview: cross-site scripting flaw in Action View [fedora-all] | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Prpič <mprpic> | ||||||||
| Component: | rubygem-actionview | Assignee: | ruby maint <ruby-maint> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 24 | CC: | jaruga, pvalena, strzibny, vondruch | ||||||||
| Target Milestone: | --- | Keywords: | Security, SecurityTracking | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | rubygem-actionview-4.2.5.2-3.fc24 rubygem-actionview-4.2.3-6.fc23 rubygem-actionview-5.0.0.1-2.fc25 | Doc Type: | Release Note | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2016-08-26 10:22:33 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | |||||||||||
| Bug Blocks: | 1365008 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Martin Prpič
2016-08-12 06:01:11 UTC
Use the following template to for the 'fedpkg update' request to submit an update for this issue as it contains the top-level parent bug(s) as well as this tracking bug. This will ensure that all associated bugs get updated when new packages are pushed to stable. ===== # bugfix, security, enhancement, newpackage (required) type=security # testing, stable request=testing # Bug numbers: 1234,9876 bugs=1365008,1366480 # Description of your update notes=Security fix for CVE-2016-6316 # Enable request automation based on the stable/unstable karma thresholds autokarma=True stable_karma=3 unstable_karma=-3 # Automatically close bugs when this marked as stable close_bugs=True # Suggest that users restart after update suggest_reboot=False ====== Additionally, you may opt to use the bodhi web interface to submit updates: https://bodhi.fedoraproject.org/updates/new I will do it for F24 and F23. Just as a information. target commit hashes. https://bugzilla.redhat.com/show_bug.cgi?id=1365008#c9 Created attachment 1191257 [details] Fix for CVE-2016-6316 Could you check my patch for f24? The patches are from https://bugzilla.redhat.com/show_bug.cgi?id=1365008#c9 4.2: https://github.com/rails/rails/commit/f05af91c68debc0230c302aa9031a253f8786b87 https://github.com/rails/rails/commit/2bcb88c9ce7d6fb1f158f54918eb7f936bd33ce9 Koji: http://koji.fedoraproject.org/koji/taskinfo?taskID=15274782 Thanks. I don't like the unnecessary change of %prep and %build sections. It makes it job and there is no reason to change it when applying security fix. IOW, please apply the patches in %prep section by addind:
```
pushd .%{gem_instdir}
%patch0 -p2
%patch2 -p2
popd
```
and keep the rest untouched. Otherwise I have no objections.
I think it is a good practice to use ``` - Fix for CVE-2016-6316 - Resolves: rhbz#1366480 ``` instead of ``` - Fix for CVE-2016-6316 (rhbz#1366480) ``` Also, I would do a single build fixing both CVE-2016-6316 and CVE-2016-6317. Otherwise it looks good. > Also, I would do a single build fixing both CVE-2016-6316 and CVE-2016-6317.
Correction: there is no common build. I was looking at an obsolete patch.
Created attachment 1191292 [details] F24 Fix for CVE-2016-6316 Vit, thanks for the review. I updated my patches. This patch is for F24. Created attachment 1191293 [details] F23 Fix for CVE-2016-6316 This patch is for f23. Koji: http://koji.fedoraproject.org/koji/taskinfo?taskID=15275482 LGTM Pavel, could you please approve the ACLs? Thx. (In reply to Pavel Valena from comment #6) > I think it is a good practice to use > > ``` > - Fix for CVE-2016-6316 > - Resolves: rhbz#1366480 > ``` > > instead of > > ``` > - Fix for CVE-2016-6316 (rhbz#1366480) > ``` I think your mentioned practice may be suitable for Red Hat products. In the case of Fedora, "Fix for CVE-2016-6316 (rhbz#1366480)" looks better, as far as I know. ACLs approved.
> I think your mentioned practice may be suitable for Red Hat products.
> In the case of Fedora, "Fix for CVE-2016-6316 (rhbz#1366480)" looks better, as far as I know.
Sure. Looks ok.
rubygem-actionview-4.2.3-6.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ab8bf51cf3 rubygem-actionview-4.2.5.2-3.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-0d9890f7b5 rubygem-actioncable-5.0.0.1-1.fc25 rubygem-actionmailer-5.0.0.1-1.fc25 rubygem-actionpack-5.0.0.1-2.fc25 rubygem-actionview-5.0.0.1-2.fc25 rubygem-activejob-5.0.0.1-1.fc25 rubygem-activemodel-5.0.0.1-1.fc25 rubygem-activerecord-5.0.0.1-1.fc25 rubygem-activesupport-5.0.0.1-1.fc25 rubygem-rails-5.0.0.1-1.fc25 rubygem-railties-5.0.0.1-2.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5760339e76 rubygem-actioncable-5.0.0.1-1.fc25, rubygem-actionmailer-5.0.0.1-1.fc25, rubygem-actionpack-5.0.0.1-2.fc25, rubygem-actionview-5.0.0.1-2.fc25, rubygem-activejob-5.0.0.1-1.fc25, rubygem-activemodel-5.0.0.1-1.fc25, rubygem-activerecord-5.0.0.1-1.fc25, rubygem-activesupport-5.0.0.1-1.fc25, rubygem-rails-5.0.0.1-1.fc25, rubygem-railties-5.0.0.1-2.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-5760339e76 rubygem-actionview-4.2.3-6.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ab8bf51cf3 rubygem-actionview-4.2.5.2-3.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-0d9890f7b5 rubygem-actionview-4.2.5.2-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. rubygem-actionview-4.2.3-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. rubygem-actioncable-5.0.0.1-1.fc25, rubygem-actionmailer-5.0.0.1-1.fc25, rubygem-actionpack-5.0.0.1-2.fc25, rubygem-actionview-5.0.0.1-2.fc25, rubygem-activejob-5.0.0.1-1.fc25, rubygem-activemodel-5.0.0.1-1.fc25, rubygem-activerecord-5.0.0.1-1.fc25, rubygem-activesupport-5.0.0.1-1.fc25, rubygem-rails-5.0.0.1-1.fc25, rubygem-railties-5.0.0.1-2.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report. |