Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(PA-6507) Patch rexml gem for CVE-2024-35176 #868

Closed
wants to merge 1 commit into from
Closed

(PA-6507) Patch rexml gem for CVE-2024-35176 #868

wants to merge 1 commit into from

Conversation

shubhamshinde360
Copy link
Contributor

@shubhamshinde360 shubhamshinde360 commented Jul 10, 2024 •
edited
Loading

  • Ruby 3.2.4 has rexml as its bundled gem, so the oatch was applied after the install step since bundled gems are available in the build after the install step in the .bundle folder.
  • Ruby 2.7.8 has rexml as its default gem, so we can go with the usual way to patch it.
  • Note that in the patch files for ruby_32, the file paths are prefixed with .bundle/gems/rexml-3.2.5 because that is where the bundled gem rexml is located with respect to the working directory of patching.
  • The upstream fix commit: ruby/rexml@4325835

@shubhamshinde360 shubhamshinde360 force-pushed the PA-6507-cve-2024-35176 branch 2 times, most recently from 541b615 to e4e77d3 Compare July 10, 2024 08:23
@shubhamshinde360
(PA-6507) Patch rexml for CVE-2024-35176
16d488b 
 - Ruby 3.2.4 has rexml as its bundled gem, so the oatch was applied after the install step since bundled gems are available in the build after the install step in the .bundle folder.
 - Ruby 2.7.8 has rexml as its default gem, so we can go with the usual way to patch it.
 - Note that in the patch files for ruby_32, the file paths are prefixed with .bundle/gems/rexml-3.2.5 because that is where the bundled gem rexml is located with respect to the working directory of patching.
 - The upstream fix commit: ruby/rexml@4325835
@shubhamshinde360
Copy link
Contributor Author

shubhamshinde360 commented Jul 10, 2024 •
edited
Loading

Tested on vanagon generic build
agent-runtime-7.x:
https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3039/
(Please ignore aix-7.2-ppc as we don't build it for 7.x but I had accidentaly added it)

agent-runtime-main:
https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3040/
Seems like there is some generic issue with solaris-11-sparc since it is also failing for the puppetlabs/master branch with the same error as above.
https://jenkins-platform.delivery.puppetlabs.net/view/vanagon-generic-builder/job/platform_vanagon-generic-builder_vanagon-packaging_generic-builder/3041/

Artifacts: https://builds.delivery.puppetlabs.net/puppet-runtime/e4e77d3944647462fea2119e1080940d50e5db81/artifacts

@joshcooper
Copy link
Contributor

Seems like there is some generic issue with solaris-11-sparc

You'll need to use solaris-11-native-sparc when building agent-runtime-main. The solaris-11-sparc platform is for agent-runtime-7.x and is cross-compiled.

To make sure you're using the correct platforms, I recommend copying the BUILD_TARGETS from the appropriate init job:

agent-runtime-7.x
agent-runtime-main

@mhashizume
Copy link
Contributor

Closing and re-opening to rekick checks.

@mhashizume mhashizume closed this Jul 10, 2024
@mhashizume mhashizume reopened this Jul 10, 2024
@joshcooper
Copy link
Contributor

@shubhamshinde360 I noticed the vanagon generic builder jobs only included a subset of platforms, e.g. included osx-14-arm64, but not osx-12-arm64. Because the former is native compiled, but the latter is cross compiled, we don't really know if this will compile on all platforms. Could you run against the full set for 7.x and main?

joshcooper
joshcooper reviewed Jul 10, 2024
View reviewed changes
resources/patches/ruby_27/rexml_for_CVE-2024-35176.patch

# Conflicts:
# lib/rexml/parsers/baseparser.rb
# lib/rexml/source.rb
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't expect conflicts. Did this occur because you cherry-picked the commit into the ruby 2.7 source tree? Is there a different patch we can use that applies cleanly?

Copy link
Contributor Author

@shubhamshinde360 shubhamshinde360 Jul 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @joshcooper,
Yes, I cherry-picked the commit ruby/rexml@4325835 into tag https://github.com/ruby/rexml/releases/tag/v3.2.5 and it conflicted.
Was not able to find other patches to apply cleanly either.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had to resolve conflicts manually, is there any other path we can take in such situations?

@shubhamshinde360
Copy link
Contributor Author

Superseded by #873

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@joshcooper joshcooper joshcooper left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@shubhamshinde360 @joshcooper @mhashizume