Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Am Mittwoch, dem 07.06.2023 um 15:28 +0200 schrieb Bernhard Schmidt: Hi Utkarsh, > > > Yep, I'm taking a look to prep something for 2.5. > > > > I've prepared a fix for the regression and uploaded the binaries > > at: > > https://people.debian.org/~utkarsh/lts/ruby2.5/ > > > > Can you please give these a try and see if that fixes the > > regression you're seeing? > > Looking good! Any news here? Bernhard
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi, It is now the third day in a row that we have to manually patch broken servers because of this update. I confirm that the u6 version works also for that 20+ servers I already had to patch and would appreciate not to have to test it on a lot more. Can you please tell us when do you plan to release these patches so my servers stop breaking one after the other and I don’t have to fix them manually? I find it quite slow to fix a wrong patch. Regards zubrick On Wed, 07 Jun 2023 17:00:27 -0700 "Chris Lamb" wrote: > No, please go ahead and do both: my availability is spotty for the next 18 > hours. :) > > (on mobile) > > > Utkarsh Gupta wrote: > > > Hi Chris, > > > > On Wed, Jun 7, 2023 at 9:01 PM Chris Lamb wrote: > >> I see your 2.5.5-3+deb10u6 update on the debian/buster branch which > >> fixes the broken +deb10u5 upload, but I don't see it in the archive > >> yet. > >> > >> Although you mentioned you were going to wait a bit more, I'm just > >> 100%-checking you aren't waiting on anything from me to upload that? > > > > Oh yeah, I wanted to sneak in some fixes and enable the tests and fix > > the failing ones with the last upload. So I'll take care of the upload > > and the announcement unless you prefer doing that since you did the > > original upload? > > > > > > > > -- > ,''`. > : :' : Chris Lamb > `. `'` la...@debian.org chris-lamb.co.uk >`- > >
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Utkarsh, I've actually managed to prepare a final update that I'm ready to upload - this has quite some fixes plus 2 new CVE fixes. Would you please test the new resulting binaries and make sure they look sane enough? :) The binaries can be found at https://people.debian.org/~utkarsh/lts/ruby2.5/. Many thanks! I don't use ruby outside of puppet, but my puppet problem is fixed with these binaries. So from my POV you can release it. Many thanks! Bernhard
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
No, please go ahead and do both: my availability is spotty for the next 18 hours. :) (on mobile) Utkarsh Gupta wrote: > Hi Chris, > > On Wed, Jun 7, 2023 at 9:01 PM Chris Lamb wrote: >> I see your 2.5.5-3+deb10u6 update on the debian/buster branch which >> fixes the broken +deb10u5 upload, but I don't see it in the archive >> yet. >> >> Although you mentioned you were going to wait a bit more, I'm just >> 100%-checking you aren't waiting on anything from me to upload that? > > Oh yeah, I wanted to sneak in some fixes and enable the tests and fix > the failing ones with the last upload. So I'll take care of the upload > and the announcement unless you prefer doing that since you did the > original upload? > > > -- ,''`. : :' : Chris Lamb `. `'` la...@debian.org chris-lamb.co.uk `-
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Bernhard, Kees, On Wed, Jun 7, 2023 at 6:58 PM Schmidt, Bernhard wrote: > > I've prepared a fix for the regression and uploaded the binaries at: > > https://people.debian.org/~utkarsh/lts/ruby2.5/ > > > > Can you please give these a try and see if that fixes the regression > > you're seeing? > > Looking good! Many thanks for testing, too! I've actually managed to prepare a final update that I'm ready to upload - this has quite some fixes plus 2 new CVE fixes. Would you please test the new resulting binaries and make sure they look sane enough? :) The binaries can be found at https://people.debian.org/~utkarsh/lts/ruby2.5/. Many thanks! - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Chris, On Wed, Jun 7, 2023 at 9:01 PM Chris Lamb wrote: > I see your 2.5.5-3+deb10u6 update on the debian/buster branch which > fixes the broken +deb10u5 upload, but I don't see it in the archive > yet. > > Although you mentioned you were going to wait a bit more, I'm just > 100%-checking you aren't waiting on anything from me to upload that? Oh yeah, I wanted to sneak in some fixes and enable the tests and fix the failing ones with the last upload. So I'll take care of the upload and the announcement unless you prefer doing that since you did the original upload? - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
On Wed, 7 Jun 2023 18:47:02 +0530 Utkarsh Gupta wrote:> I've prepared a fix for the regression and uploaded the binaries at: https://people.debian.org/~utkarsh/lts/ruby2.5/ Can you please give these a try and see if that fixes the regression you're seeing? These packages also fix the Puppet regression reported here, on our buster systems. Thanks, -- Jérôme
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Utkarsh, > I had missed your comment in the bug but super, many thanks for > testing this out! I'll wait a bit more before I roll this out. I see your 2.5.5-3+deb10u6 update on the debian/buster branch which fixes the broken +deb10u5 upload, but I don't see it in the archive yet. Although you mentioned you were going to wait a bit more, I'm just 100%-checking you aren't waiting on anything from me to upload that? Best wishes, -- ,''`. : :' : Chris Lamb `. `'` la...@debian.org chris-lamb.co.uk `-
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Am Mittwoch, dem 07.06.2023 um 18:47 +0530 schrieb Utkarsh Gupta: Hi, > > Yep, I'm taking a look to prep something for 2.5. > > I've prepared a fix for the regression and uploaded the binaries at: > https://people.debian.org/~utkarsh/lts/ruby2.5/ > > Can you please give these a try and see if that fixes the regression > you're seeing? Looking good! # puppet agent --test Info: Using configured environment 'production' Info: Retrieving pluginfacts Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Info: Retrieving plugin Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Info: Retrieving locales [..] # dpkg -i libruby2.5_2.5.5-3+deb10u6_amd64.deb (Reading database ... 69723 files and directories currently installed.) Preparing to unpack libruby2.5_2.5.5-3+deb10u6_amd64.deb ... Unpacking libruby2.5:amd64 (2.5.5-3+deb10u6) over (2.5.5-3+deb10u5) ... Setting up libruby2.5:amd64 (2.5.5-3+deb10u6) ... Processing triggers for libc-bin (2.28-10+deb10u2) ... # puppet agent --test Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for xxx.lrz.de Info: Applying configuration version 'master-3a083818c9e2' Notice: Applied catalog in 3.86 seconds Bernhard
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Kees, On Wed, Jun 7, 2023 at 6:53 PM Kees Meijs | Nefos wrote: > I know you were asking Bernhard, but I downloaded and installed as well. > Our Puppet agent seems to be happy again. I had missed your comment in the bug but super, many thanks for testing this out! I'll wait a bit more before I roll this out. There's also CVE-2021-33621 and CVE-2022-28739 open for ruby2.5 in buster, I'll try to include the fixes in this update, too. - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Utkarsh, Many thanks from our end. I know you were asking Bernhard, but I downloaded and installed as well. Our Puppet agent seems to be happy again. Cheers, Kees On 07-06-2023 15:17, Utkarsh Gupta wrote: I've prepared a fix for the regression and uploaded the binaries at: https://people.debian.org/~utkarsh/lts/ruby2.5/ Can you please give these a try and see if that fixes the regression you're seeing?
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Bernhard, On Wed, Jun 7, 2023 at 4:16 PM Utkarsh Gupta wrote: > Yep, I'm taking a look to prep something for 2.5. I've prepared a fix for the regression and uploaded the binaries at: https://people.debian.org/~utkarsh/lts/ruby2.5/ Can you please give these a try and see if that fixes the regression you're seeing? - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
FWIW, in Ubuntu, we had a similar issue trying to fix this CVE in ruby2.7, and in the end we reverted the fix: https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.10 Lucas Kanashiro. Em qua., 7 de jun. de 2023 07:47, Utkarsh Gupta escreveu: > Hiya, > > On Wed, Jun 7, 2023 at 2:39 PM Moritz Muehlenhoff wrote: > > Specifically > https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/ > > states: > > > > | For Ruby 2.7: Update to uri 0.10.0.1 > > | For Ruby 3.0: Update to uri 0.10.2 > > | For Ruby 3.1: Update to uri 0.11.1 > > | For Ruby 3.2: Update to uri 0.12.1 > > > > And the 0.10 change ( > https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70 > ) > > is different from the 0.12 one ( > https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175 > ) > > > > There might be other changes needed for 2.5, not sure. > > Yep, I'm taking a look to prep something for 2.5. > > > - u > >
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hiya, On Wed, Jun 7, 2023 at 2:39 PM Moritz Muehlenhoff wrote: > Specifically > https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/ > states: > > | For Ruby 2.7: Update to uri 0.10.0.1 > | For Ruby 3.0: Update to uri 0.10.2 > | For Ruby 3.1: Update to uri 0.11.1 > | For Ruby 3.2: Update to uri 0.12.1 > > And the 0.10 change > (https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70) > is different from the 0.12 one > (https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175) > > There might be other changes needed for 2.5, not sure. Yep, I'm taking a look to prep something for 2.5. - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi there, In our stack I see the exact same issue. Cheers, Kees On 07-06-2023 11:09, Moritz Muehlenhoff wrote: It's definitely related to the fix for CVE-2023-28755, reverting that patch unbreaks Puppet. I'd recommend to go ahead with a revert for now.
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
On Wed, Jun 07, 2023 at 01:43:26PM +0530, Utkarsh Gupta wrote: > Hi Chris, > > On Wed, Jun 7, 2023 at 12:56 PM Salvatore Bonaccorso > wrote: > > Can you please have a look, as this seems to be caused by the DLA > > issued as DLA-3447-1. > > This has been caused by the ruby2.5 update. It's definitely related to the fix for CVE-2023-28755, reverting that patch unbreaks Puppet. I'd recommend to go ahead with a revert for now. > Can you please TAL? This > is perhaps because of the URI version in buster v/s URI version > upstream. The upstream patch was supposed to be for 3.2 and was not > 2.5 compliant. Let me know if you'd like me to help. Specifically https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/ states: | For Ruby 2.7: Update to uri 0.10.0.1 | For Ruby 3.0: Update to uri 0.10.2 | For Ruby 3.1: Update to uri 0.11.1 | For Ruby 3.2: Update to uri 0.12.1 And the 0.10 change (https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70) is different from the 0.12 one (https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175) There might be other changes needed for 2.5, not sure. Cheers, Moritz
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi Chris, On Wed, Jun 7, 2023 at 12:56 PM Salvatore Bonaccorso wrote: > Can you please have a look, as this seems to be caused by the DLA > issued as DLA-3447-1. This has been caused by the ruby2.5 update. Can you please TAL? This is perhaps because of the URI version in buster v/s URI version upstream. The upstream patch was supposed to be for 3.2 and was not 2.5 compliant. Let me know if you'd like me to help. - u
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Hi LTS team, On Wed, Jun 07, 2023 at 08:44:53AM +0200, Bernhard Schmidt wrote: > Package: libruby2.5 > Version: 2.5.5-3+deb10u5 > Severity: grave > > Hi, > > I can't quite figure out why, but the latest security upload of ruby2.5 in > Buster breaks the ability of the puppet agent to pull files from the master > > With 2.5.5-3+deb10u4: > # puppet agent --onetime --server puppet-kom.srv.lrz.de --test > --no-daemonize > Info: Using configured environment 'production' > Info: Retrieving pluginfacts > Info: Retrieving plugin > Info: Retrieving locales > Info: Loading facts > Info: Caching catalog for simrad3.slb.lrz.de > Info: Applying configuration version 'master-70189ef6ab5a' > > > # apt dist-upgrade > Reading package lists... Done > Building dependency tree > Reading state information... Done > Calculating upgrade... Done > The following packages will be upgraded: > libruby2.5 ruby2.5 > 2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. > Need to get 3841 kB of archives. > After this operation, 2048 B of additional disk space will be used. > Do you want to continue? [Y/n] > Get:1 http://debian.mirror.lrz.de/debian-security buster/updates/main amd64 > libruby2.5 amd64 2.5.5-3+deb10u5 [3440 kB] > Get:2 http://debian.mirror.lrz.de/debian-security buster/updates/main amd64 > ruby2.5 amd64 2.5.5-3+deb10u5 [401 kB] > Fetched 3841 kB in 0s (30.3 MB/s) > Reading changelogs... Done > (Reading database ... 58907 files and directories currently installed.) > Preparing to unpack .../libruby2.5_2.5.5-3+deb10u5_amd64.deb ... > Unpacking libruby2.5:amd64 (2.5.5-3+deb10u5) over (2.5.5-3+deb10u4) ... > Preparing to unpack .../ruby2.5_2.5.5-3+deb10u5_amd64.deb ... > Unpacking ruby2.5 (2.5.5-3+deb10u5) over (2.5.5-3+deb10u4) ... > Setting up libruby2.5:amd64 (2.5.5-3+deb10u5) ... > Setting up ruby2.5 (2.5.5-3+deb10u5) ... > Processing triggers for man-db (2.8.5-2) ... > Processing triggers for libc-bin (2.28-10+deb10u2) ... > > # puppet agent --onetime --server puppet-kom.srv.lrz.de --test > --no-daemonize > Info: Using configured environment 'production' > Info: Retrieving pluginfacts > Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional > resources using 'eval_generate': Failed to open TCP connection to :8140 > (Connection refused - connect(2) for "" port 8140) > Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve > file metadata for puppet:///pluginfacts: Failed to open TCP connection to > :8140 (Connection refused - connect(2) for "" port 8140) > Info: Retrieving plugin > Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources > using 'eval_generate': Failed to open TCP connection to :8140 (Connection > refused - connect(2) for "" port 8140) > Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve > file metadata for puppet:///plugins: Failed to open TCP connection to :8140 > (Connection refused - connect(2) for "" port 8140) > Info: Retrieving locales > Error: /File[/var/lib/puppet/locales]: Failed to generate additional > resources using 'eval_generate': Failed to open TCP connection to :8140 > (Connection refused - connect(2) for "" port 8140) > Error: /File[/var/lib/puppet/locales]: Could not evaluate: Could not retrieve > file metadata for puppet:///locales: Failed to open TCP connection to :8140 > (Connection refused - connect(2) for "" port 8140) > Info: Loading facts > Info: Caching catalog for simrad3.slb.lrz.de > Info: Applying configuration version 'master-70189ef6ab5a' > Error: > /Stage[main]/Lrz_kom_radius::Radiussimrad/File[/etc/freeradius/.git/hooks/post-commit]: > Could not evaluate: Could not retrieve file metadata for > puppet:///modules/lrz_kom/classes/radius/git_post-commit_hook: Failed to open > TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) > Error: > /Stage[main]/Lrz_common::Distributions::Debian::Vim/File[/etc/vim/vimrc.lrz-puppet]: > Could not evaluate: Could not retrieve file metadata for > puppet:///modules/lrz_common/vimrc.lrz-puppet: Failed to open TCP connection > to :8140 (Connection refused - connect(2) for "" port 8140) > Error: > /Stage[main]/Lrz_common::Distributions::Debian::Emacs/File[//etc/emacs/site-start.d/99lrz.el]: > Could not evaluate: Could not retrieve file metadata for > puppet:///modules/lrz_common/emacs/99lrz.el: Failed to open TCP connection to > :8140 (Connection refused - connect(2) for "" port 8140) > Error: > /Stage[main]/Lrz_common::Distributions::Debian/File[/etc/apt/trusted.gpg.d/debian-lrz.asc]: > Could not evaluate: Could not retrieve file metadata for > puppet:///modules/lrz_common/debian/debian-lrz.asc: Failed to open TCP > connection to :8140 (Connection refused - connect(2) for "" port 8140) > Error: /Stage[main]/Puppetclient::Config/File[/usr/bin/waitrandom]: Could not > evaluate: Could not retrieve file metadata for > puppet:///modules/puppetclient/waitrandom: Failed to open TCP
Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Package: libruby2.5 Version: 2.5.5-3+deb10u5 Severity: grave Hi, I can't quite figure out why, but the latest security upload of ruby2.5 in Buster breaks the ability of the puppet agent to pull files from the master With 2.5.5-3+deb10u4: # puppet agent --onetime --server puppet-kom.srv.lrz.de --test --no-daemonize Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for simrad3.slb.lrz.de Info: Applying configuration version 'master-70189ef6ab5a' # apt dist-upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages will be upgraded: libruby2.5 ruby2.5 2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 3841 kB of archives. After this operation, 2048 B of additional disk space will be used. Do you want to continue? [Y/n] Get:1 http://debian.mirror.lrz.de/debian-security buster/updates/main amd64 libruby2.5 amd64 2.5.5-3+deb10u5 [3440 kB] Get:2 http://debian.mirror.lrz.de/debian-security buster/updates/main amd64 ruby2.5 amd64 2.5.5-3+deb10u5 [401 kB] Fetched 3841 kB in 0s (30.3 MB/s) Reading changelogs... Done (Reading database ... 58907 files and directories currently installed.) Preparing to unpack .../libruby2.5_2.5.5-3+deb10u5_amd64.deb ... Unpacking libruby2.5:amd64 (2.5.5-3+deb10u5) over (2.5.5-3+deb10u4) ... Preparing to unpack .../ruby2.5_2.5.5-3+deb10u5_amd64.deb ... Unpacking ruby2.5 (2.5.5-3+deb10u5) over (2.5.5-3+deb10u4) ... Setting up libruby2.5:amd64 (2.5.5-3+deb10u5) ... Setting up ruby2.5 (2.5.5-3+deb10u5) ... Processing triggers for man-db (2.8.5-2) ... Processing triggers for libc-bin (2.28-10+deb10u2) ... # puppet agent --onetime --server puppet-kom.srv.lrz.de --test --no-daemonize Info: Using configured environment 'production' Info: Retrieving pluginfacts Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Info: Retrieving plugin Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Info: Retrieving locales Error: /File[/var/lib/puppet/locales]: Failed to generate additional resources using 'eval_generate': Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /File[/var/lib/puppet/locales]: Could not evaluate: Could not retrieve file metadata for puppet:///locales: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Info: Loading facts Info: Caching catalog for simrad3.slb.lrz.de Info: Applying configuration version 'master-70189ef6ab5a' Error: /Stage[main]/Lrz_kom_radius::Radiussimrad/File[/etc/freeradius/.git/hooks/post-commit]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/lrz_kom/classes/radius/git_post-commit_hook: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /Stage[main]/Lrz_common::Distributions::Debian::Vim/File[/etc/vim/vimrc.lrz-puppet]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/lrz_common/vimrc.lrz-puppet: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /Stage[main]/Lrz_common::Distributions::Debian::Emacs/File[//etc/emacs/site-start.d/99lrz.el]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/lrz_common/emacs/99lrz.el: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /Stage[main]/Lrz_common::Distributions::Debian/File[/etc/apt/trusted.gpg.d/debian-lrz.asc]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/lrz_common/debian/debian-lrz.asc: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Error: /Stage[main]/Puppetclient::Config/File[/usr/bin/waitrandom]: Could not evaluate: Could not retrieve file metadata for puppet:///modules/puppetclient/waitrandom: Failed to open TCP connection to :8140 (Connection refused - connect(2) for "" port 8140) Notice: Applied catalog in 1.82 seconds Note the empty servername in the "Failed to open TCP connection" messages. Bernhard
