Description of problem: rubygem-rack version in EPEL 6 is out of date. There are outstanding, exploitable CVEs: CVE-2013-0262 CVE-2013-0263 There may be more. These are particularly bad. Version-Release number of selected component (if applicable): 1.1.0-2 How reproducible: Very Steps to Reproduce: 1. Install RPM 2. Exploit using steps outlined in CVE Actual results: Fail security scans. Expected results: Pass security scans with a newer version of Rack. Additional info: http://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/rubygem-rack.html
Where to obtain the version that has the fix (1.1.6): http://rack.github.io/ https://groups.google.com/forum/#!msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J
Hi Sean, The whiteboard field of https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0262 has marked the epel versions as being not affected, possibly due to the "Versions affected: All versions after 1.4.0" text in the original report. If you believe it is affected I can make a tracking bug (although probably not really needed, since you have filed this one). Cheers, -- Murray McAllister / Red Hat Security Response Team
(In reply to Murray McAllister from comment #2) > The whiteboard field of > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0262 has marked the > epel versions as being not affected, possibly due to the "Versions affected: > All versions after 1.4.0" text in the original report. What about CVE-2013-0263? The rack webpage (look under the News headline) and google group post seem to indicate the 1.1.x series is affected by that one. "Some notes on CVE-2013-0263 that affects all prior versions:" Thanks, Sean
(In reply to sean.edge from comment #3) > (In reply to Murray McAllister from comment #2) > > > The whiteboard field of > > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0262 has marked the > > epel versions as being not affected, possibly due to the "Versions affected: > > All versions after 1.4.0" text in the original report. > > What about CVE-2013-0263? The rack webpage (look under the News headline) > and google group post seem to indicate the 1.1.x series is affected by that > one. > > "Some notes on CVE-2013-0263 that affects all prior versions:" > > Thanks, > Sean It is affected by that one. The top level bug is https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0263 The EPEL specific one is https://bugzilla.redhat.com/show_bug.cgi?id=909088 (no movement on it yet)
This message is a reminder that EPEL 6 is nearing its end of life. Fedora will stop maintaining and issuing updates for EPEL 6 on 2020-11-30. It is our policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of 'el6'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later EPEL version. Thank you for reporting this issue and we are sorry that we were not able to fix it before EPEL 6 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above.
This message is a reminder that EPEL 6 is nearing its end of life. Fedora will stop maintaining and issuing updates for EPEL 6 on 2020-11-30. It is policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of 'el6'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later EPEL version. Thank you for reporting this issue and we are sorry that we were not able to fix it before EPEL 6 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version, you are encouraged to change the 'version' to a later version prior this bug is closed as described in the policy above.
EPEL el6 changed to end-of-life (EOL) status on 2020-11-30. EPEL el6 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of EPEL please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.