4 ms·
Vulnerability in Sendmail Delivery Agent code in Mail, affects Rails
"An attacker could craft an email address used to send out an email and inject code that would be executed by the system shell.
All users who are using sendmail to deliver their system email and running a 2.2.14 or earlier release of Mail should upgrade immediately."
- rmoriz 16y agomissleading subject: only the rubygem "mail" is affected. Not sendmail or mail(8) itself.
- wlll 16y agoVulnerability in Sendmail Delivery Agent code in Mail It affects the code in Mail that sends mail using the sendmail MTA.
- rmoriz 16y agoit's not mail(8). it's just the rubygem "mail".
- idm 16y agoTotally misleading - a headline like this would be really major news. A live, unpatched exploit in mail(8), given the number of unix systems that would be affected (and the nature of the vuln), could open up tons of internet systems to rtm-style worms. I emphasize could - but come on, the reality of the story linked from this headline is that it's way less severe - maybe just some spam-related consequences. A better headline: "ruby mail agent vulnerable, affects rails" ... or something...
- davidw 16y agoThis is where having a centralized gem repository might come in handy... If you have 15 projects, you're going to have to go update each and every one.
- rmoriz 16y agoUsually you do a bundle install when deploying. If you've specified >= 2.2.14 in your Gemfile you just have to redeploy: "cap deploy". Thanks to user wycats (+team) for bundler. :)
- davidw 16y agoSo you still have to redeploy all your 15 projects, as opposed to just fetching the new gem.
- tomafro 16y agoYou'll also have to do 'bundle update <broken-gem>', commit the resulting Gemfile.lock and hopefully wait for your CI build to pass before deploying. Doing that 15 times would be onerous.