On Wed, Oct 22, 2014 at 10:14 AM, Michael Stahnke <stahnma@puppetlabs.com> wrote:
After a very long period of neglect, (sorry), I worked on updating the rails stack in EPEL5 to 2.3.18. This includes activesupport, activerecord and actionpack thus far. Rails still to come. 

Moving from 2.1.x to 2.3.x *should* be a clean upgrade, but I know in some cases it's not, as some security fixes required minor behavioral changes. 

I'd appreciate karma and feedback here if anybody is still using this old stack on EPEL5.



The bugs and CVEs addressed are plentiful. 
  • Bug 1095122 - CVE-2014-0130
  • Bug 1095125 - CVE-2014-0130
  • Bug 677626 - CVE-2011-0446
  • Bug 677629 - CVE-2011-0446, CVE-2011-0447
  • Bug 677631 - CVE-2011-0447
  • Bug 731435 - CVE-2011-2932
  • Bug 731438 - CVE-2011-2930
  • Bug 731450 - CVE-2011-2932
  • Bug 731453 - CVE-2011-2930
  • Bug 744706 - CVE-2010-3933
  • Bug 831583 - CVE-2012-2695
  • Bug 843924 - CVE-2012-3424
  • Bug 847202 - CVE-2013-0156
  • Bug 891468 - CVE-2012-5664
  • Bug 905373 - CVE-2013-0333
  • Bug 921329 - CVE-2013-1854
  • Bug 924297 - CVE-2013-1855, CVE-2013-1857
  • Bug 924318 - CVE-2013-1854
  • Bug 948706 - CVE-2013-0276

https://admin.fedoraproject.org/updates/rubygem-rails-2.3.18-1.el5,rubygem-actionmailer-2.3.18-1.el5,rubygem-activeresource-2.3.18-1.el5?_csrf_token=2d38be86ac50ac79b7baa258fde12a02b58bf46d is the update I made tonight that contains rails, activeresource and actionmailer. 

Hopefully these updates all go through and we have a more secure rails stack in epel5. 

Karma appreciated.