Bug 1774605 - Ceph 4 building outdated 8 years old version of python-repoze-lru
Summary: Ceph 4 building outdated 8 years old version of python-repoze-lru
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: Distribution
Version: 4.0
Hardware: Unspecified
OS: Linux
medium
medium
Target Milestone: ---
: 4.2
Assignee: Timothy Asir
QA Contact: Sunil Angadi
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-20 14:37 UTC by Hardik Vyas
Modified: 2021-01-12 14:56 UTC (History)
5 users (show)

Fixed In Version: python-repoze-lru-0.7-6.el8ost, python-repoze-lru-0.7-8.el7cp
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-01-12 14:55:53 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0081 0 None None None 2021-01-12 14:56:15 UTC

Description Hardik Vyas 2019-11-20 14:37:39 UTC
While doing security audit on packages getting build with Ceph-4, came across package 
'python-repoze-lru' which is not updated since Sep 4, 2011(version 0.4) in downstream. 
The latest release in upstream is 0.7 from Sep 7, 2017.

Project Homepage: http://pypi.python.org/pypi/repoze.lru
                  https://github.com/repoze/repoze.lru


Checking the dependencies python3-repoze-lru is required by:

ceph-mgr-dashboard-2:14.2.4-60.el8cp.noarch
python3-routes-0:2.4.1-2.el8ost.noarch

Considering security implications, we might want to remove this package in future if 
nothing is actually using it or use the updated one.

Comment 1 Yaniv Kaul 2020-01-14 14:25:04 UTC
Is the package being used by anyone?

Comment 2 Ernesto Puerta 2020-01-14 16:57:26 UTC
The exact dependency chain is: ceph-dashboard -> python3-cherrypy -> python3-routes -> python3-repoze-lru.

I couldn't find any CVEs for repoze-lru package, and checked the commit history between 0.4..0.7, and ~6 commits out of 85 are bugfixes (the remaining are Python 2-3 compatibility-related, docs, tests/coverage, new functionality and clean-ups). None of those bugfixes seem security related.

@Timothy, nevertheless, could you please take care of looking how to upgrade python3-repoze-lru to a newer version? Thanks!

Comment 3 Yaniv Kaul 2020-04-30 13:39:39 UTC
Any news?

Comment 5 Timothy Asir 2020-09-17 09:39:25 UTC
(In reply to Ernesto Puerta from comment #2)
> The exact dependency chain is: ceph-dashboard -> python3-cherrypy ->
> python3-routes -> python3-repoze-lru.
> 
> I couldn't find any CVEs for repoze-lru package, and checked the commit
> history between 0.4..0.7, and ~6 commits out of 85 are bugfixes (the
> remaining are Python 2-3 compatibility-related, docs, tests/coverage, new
> functionality and clean-ups). None of those bugfixes seem security related.
> 
> @Timothy, nevertheless, could you please take care of looking how to upgrade
> python3-repoze-lru to a newer version? Thanks!

Sure @Ernesto. Thank you!

Comment 15 errata-xmlrpc 2021-01-12 14:55:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Red Hat Ceph Storage 4.2 Security and Bug Fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:0081


Note You need to log in before you can comment on or make changes to this bug.