Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PCS 0.10.18 build rpm failure #905

Closed
ssathish062087 opened this issue Dec 12, 2024 · 7 comments
Closed

PCS 0.10.18 build rpm failure #905

ssathish062087 opened this issue Dec 12, 2024 · 7 comments

Comments

@ssathish062087
Copy link

Hi Team,

PCS 0.10.18 build rpm(make rpm) command failed with below error message.

make[2]: Leaving directory '/root/smf_source_latest/pcs-0.10.18'
cp pcs-0.10.18.tar.bz2 pcs-0.10.18.tar.gz pcs-0.10.18.tar.xz /root/smf_source_latest/pcs-0.10.18/rpm
make[1]: 'pcs-0.10.18.tar.gz' is up to date.
make[1]: 'pcs-0.10.18.tar.xz' is up to date.
make[1]: Leaving directory '/root/smf_source_latest/pcs-0.10.18'
rpmbuild --define "_sourcedir /root/smf_source_latest/pcs-0.10.18/rpm" --define "_specdir /root/smf_source_latest/pcs-0.10.18/rpm" --define "_builddir /root/smf_source_latest/pcs-0.10.18/rpm" --define "_srcrpmdir /root/smf_source_latest/pcs-0.10.18/rpm" --define "_rpmdir /root/smf_source_latest/pcs-0.10.18/rpm" -ba rpm/pcs.spec
error: line 8: Illegal sequence ".." in: Release: 99+git..el8
make: *** [Makefile:1312: rpm] Error 1

Thanks and Regards,
S Sathish
@tomjelinek
Copy link
Member

Hi @ssathish062087,

Could you share the whole process of building pcs, all commands and their whole output, starting with downloading pcs sources?

@ssathish062087
Copy link
Author

ssathish062087 commented Dec 16, 2024 via email

@CtrlZmaster
Copy link
Member

Hello @ssathish062087,

Tomas has looked at the issue and was able to reproduce it. The bug was introduced in ba60064 and already fixed in 20820b6. Unfortunately, the bug was fixed only after the 0.10.18 version, leading to problems with building it using make rpm. The bug only manifests when building a released tarball, or more generally, a tagged commit. No other version than 0.10.18 is affected.

I am in a process of creating the 0.10.19 release to fix this issue in #906. You can expect to see an announcement on the ClusterLabs users mailing list when it is available.

@ssathish062087
Copy link
Author

ssathish062087 commented Dec 18, 2024 via email

@CtrlZmaster
Copy link
Member

I just published the release, you can find it here: https://github.com/ClusterLabs/pcs/releases/tag/v0.10.19

@ssathish062087
Copy link
Author

ssathish062087 commented Dec 20, 2024 via email

@CtrlZmaster
Copy link
Member

Hello @ssathish062087,

There has been a number of similar attacks on Sinatra, Puma and Rack in the past, so we decided to add an extra security layer. Pcsd actually comprises of 2 services - pcsd which is the Python daemon and pcsd-ruby, which is the legacy Ruby daemon. Only pcsd handles incoming traffic from the network. Pcsd-ruby is not exposed to the outside network, it only listen on a Unix socket. Pcsd resends some of the original requests to pcsd-ruby. This new extra security layer removes any HTTP headers that are not useful to pcsd-ruby before the request is resent there.

So, in a true sense of the word, this is a mitigation for CVE-2024-21510 and similar future attacks because the prerequisites to exploit this kind of flaw are not met. However, this fix is not critical or even needed, using up-to-date rubygems (Sinatra 4.1.0 in this case) mitigates this vulnerability as well.

I believe that this issue is now resolved and I will close it on January 2, 2025 if it is not closed yet and there are no new questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tomjelinek @CtrlZmaster @ssathish062087