Description of problem: system hitting CVE-2022-28739, as this cve page https://access.redhat.com/security/cve/cve-2022-28739 Red Hat Enterprise Linux 8 ruby:3.0 Fixed RHSA-2022:6450 September 13, 2022 Red Hat Enterprise Linux 8 ruby:2.7 Fixed RHSA-2022:6447 September 13, 2022 Red Hat Enterprise Linux 8 ruby:2.6 Fixed RHSA-2022:5338 July 1, 2022 Red Hat Enterprise Linux 8 ruby Will not fix. <========== from ruby module below, system have 2.5 stream enabled , so it "will not fix" for this cve. # dnf module list ruby Name Stream Profiles Summary ruby 2.5 [d][e] common [d] An interpreter of object-oriented scripting language ruby 2.6 common [d] An interpreter of object-oriented scripting language ruby 2.7 common [d] An interpreter of object-oriented scripting language ruby 3.0 common [d] An interpreter of object-oriented scripting language ruby 3.1 common [d] An interpreter of object-oriented scripting language so my idea is trying to switch ruby stream to 3.1. but from my test, after switching, the cluster package "pcs" was removed by this switching process! Version-Release number of selected component (if applicable): Rhel 8.8 with pcs-0.10.15-4.el8_8.1.x86_64 and ruby 2.5.9 How reproducible: Steps to Reproduce: 1. follow steps here to switch ruby stream to 3.1: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_managing_and_removing_user-space_components/managing-versions-of-appstream-content_using-appstream 2.but when run “yum distro-sync”, it show error here: ******* [root@reli-rhel8-ha1 ~]# yum distro-sync Updating Subscription Management repositories. Last metadata expiration check: 1:58:13 ago on Thu 29 Jun 2023 02:45:34 AM EDT. Error: Problem 1: package pcs-0.10.15-4.el8_8.1.x86_64 requires libruby.so.2.5()(64bit), but none of the providers can be installed - cannot install the best update candidate for package pcs-0.10.14-5.el8_7.2.x86_64 - ruby-libs-2.5.9-110.module+el8.6.0+15956+aa803fc1.x86_64 does not belong to a distupgrade repository - package ruby-libs-2.5.3-103.module+el8+2671+ebcc7ee0.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.3-104.module+el8.0.0+3250+4b7d6d43.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.5-105.module+el8.1.0+3656+f80bfa1d.x86_64 is filt ………… ……….. - package ruby-libs-2.5.9-109.module+el8.5.0+14275+d9c243ca.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.9-110.module+el8.6.0+15956+aa803fc1.x86_64 is filtered out by modular filtering (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) ************* 3.3, then run “yum --allowerasing distro-sync” by following kb below: https://access.redhat.com/articles/4422071 Then it seem worked, but to my surprise, the “pcs” package (which is pacemaker management tools will be removed by this process!!!!, like below: ************* [root@reli-rhel8-ha1 ~]# yum --allowerasing distro-sync Updating Subscription Management repositories. Last metadata expiration check: 4:29:42 ago on Thu 29 Jun 2023 01:36:53 AM EDT. Dependencies resolved. ========================================================================================================================================================================================== Package Architecture Version Repository Size ========================================================================================================================================================================================== Installing: kernel x86_64 4.18.0-477.15.1.el8_8 rhel-8-for-x86_64-baseos-rpms 9.4 M kernel-core x86_64 4.18.0-477.15.1.el8_8 rhel-8-for-x86_64-baseos-rpms 42 M kernel-modules x86_64 4.18.0-477.15.1.el8_8 rhel-8-for-x86_64-baseos-rpms 34 M Upgrading: ………….. …………… Removing: kernel x86_64 4.18.0-372.32.1.el8_6 @rhel-8-for-x86_64-baseos-rpms 0 kernel-core x86_64 4.18.0-372.32.1.el8_6 @rhel-8-for-x86_64-baseos-rpms 69 M kernel-modules x86_64 4.18.0-372.32.1.el8_6 @rhel-8-for-x86_64-baseos-rpms 24 M Removing dependent packages: pcs x86_64 0.10.15-4.el8_8.1 @rhel-8-for-x86_64-highavailability-rpms 30 M <============ ******************** 4, Even after “pcs” was removed , it can’t be installed anymore: # yum install pcs Updating Subscription Management repositories. Last metadata expiration check: 3:08:05 ago on Thu 29 Jun 2023 02:45:34 AM EDT. Error: Problem: package pcs-0.10.15-4.el8_8.1.x86_64 requires libruby.so.2.5()(64bit), but none of the providers can be installed - cannot install the best candidate for the job - package ruby-libs-2.5.3-103.module+el8+2671+ebcc7ee0.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.3-104.module+el8.0.0+3250+4b7d6d43.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.5-105.module+el8.1.0+3656+f80bfa1d.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.5-106.module+el8.3.0+7153+c6f6daa5.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.9-107.module+el8.4.0+10822+fe4fffb1.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.9-107.module+el8.5.0+13840+ec418553.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.9-109.module+el8.5.0+14275+d9c243ca.x86_64 is filtered out by modular filtering - package ruby-libs-2.5.9-110.module+el8.6.0+15956+aa803fc1.x86_64 is filtered out by modular filtering (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) Actual results: pcs package was removed after ruby stream switch to 3.1 from 2.5.9. Expected results: pcs package remain intact after ruby stream switch to 3.1. Additional info:
In short, this behavior is expected unfortunately. Let me quote a note from the documentation you have linked above: "If certain installed packages depend on the earlier stream, and there is no compatible version in the later stream, yum reports a dependency conflict. In this case, use the --allowerasing option to remove such packages because they cannot be installed together with the later stream due to missing dependencies." In more detail, the pcs package is bare/plain RPM, build against default module, which is Ruby 2.5 in RHEL 8. In ideal world, as was imagined with introduction of modularity, the pcs would also be modular package and the modular expansion would ensure, that the pcs is build against all available Ruby modules. But as you can imagine, this greatly expands the support matrix, therefore this ware never really implemented in practice. Our recommendation for cases like this is captured in this [1] part of the documentation: "Only one stream of a particular module can be active at a given point in time. Therefore, only one version of a component can be installed on a system. Different versions can be used in separate containers." I hope this explanation help and closing as NOTABUG. [1]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/installing_managing_and_removing_user-space_components/index#module-streams_introduction-to-modules
Thanks, Vit. But customer is very concerning CVE-2022-28739. it seem pcs package is "hard dependence" on ruby, I am seeing the same symptom if I tried switch to ruby. If possible to avoid such conflict if we install ruby stream (in rhel 8) before pcs package installation? (in my previous experience, it seem ruby was installed as dependence when we run "yum install pcs" in a fresh system. --William
(In reply to William LEE from comment #3) > Thanks, Vit. > > But customer is very concerning CVE-2022-28739. That is something we might be able to help to address. Please keep the discussion in the appropriate trackers. > it seem pcs package > is "hard dependence" on ruby, I am seeing the same symptom if I tried > switch to ruby. That is correct. pcs seems to have some binary extension which depends on Ruby 2.5 > If possible to avoid such conflict if we install ruby stream (in > rhel 8) before pcs package installation? (in my previous experience, it seem > ruby was installed as dependence when we run "yum install pcs" in a > fresh system. pcs and ruby:3.1 unfortunately can't be installed at the same time, unless you go with container or similar technology. You would need to ask the pcs maintainer to build pcs against ruby:3.1, but that would mean also modularizing pcs and I don't think they'll be open to this idea.