Re: [EPEL-devel] Rails stack update in EL5

[Michael Stahnke]

On Wed, Oct 22, 2014 at 10:14 AM, Michael Stahnke <stahnma(a)puppetlabs.com&gt;
wrote:

>  After a very long period of neglect, (sorry), I worked on updating
> the
>  rails stack in EPEL5 to 2.3.18. This includes activesupport, activerecord
>  and actionpack thus far. Rails still to come.
>
>  Moving from 2.1.x to 2.3.x *should* be a clean upgrade, but I know in some
>  cases it's not, as some security fixes required minor behavioral changes.
>
>  I'd appreciate karma and feedback here if anybody is still using this old
>  stack on EPEL5.
>
>
>
>
> https://admin.fedoraproject.org/updates/rubygem-actionpack-2.3.18-1.el5,r...
>
>  The bugs and CVEs addressed are plentiful.
>
>     - Bug 1095122 - CVE-2014-0130
>     - Bug 1095125 - CVE-2014-0130
>     - Bug 677626 - CVE-2011-0446
>     - Bug 677629 - CVE-2011-0446, CVE-2011-0447
>     - Bug 677631 - CVE-2011-0447
>     - Bug 731435 - CVE-2011-2932
>     - Bug 731438 - CVE-2011-2930
>     - Bug 731450 - CVE-2011-2932
>     - Bug 731453 - CVE-2011-2930
>     - Bug 744706 - CVE-2010-3933
>     - Bug 831583 - CVE-2012-2695
>     - Bug 843924 - CVE-2012-3424
>     - Bug 847202 - CVE-2013-0156
>     - Bug 891468 - CVE-2012-5664
>     - Bug 905373 - CVE-2013-0333
>     - Bug 921329 - CVE-2013-1854
>     - Bug 924297 - CVE-2013-1855, CVE-2013-1857
>     - Bug 924318 - CVE-2013-1854
>     - Bug 948706 - CVE-2013-0276
https://admin.fedoraproject.org/updates/rubygem-rails-2.3.18-1.el5,rubyge...
is the update I made tonight that contains rails, activeresource and
actionmailer.

Hopefully these updates all go through and we have a more secure rails
stack in epel5.

Karma appreciated.