Vulnerability in Sendmail Delivery Agent code in Mail, affects Rails

groups.google.com

12 points·wlll··8 comments

"An attacker could craft an email address used to send out an email and inject code that would be executed by the system shell.

All users who are using sendmail to deliver their system email and running a 2.2.14 or earlier release of Mail should upgrade immediately."

Open articleView on HN

missleading subject: only the rubygem "mail" is affected. Not sendmail or mail(8) itself.

Vulnerability in Sendmail Delivery Agent code in Mail

It affects the code in Mail that sends mail using the sendmail MTA.

it's not mail(8). it's just the rubygem "mail".

Totally misleading - a headline like this would be really major news. A live, unpatched exploit in mail(8), given the number of unix systems that would be affected (and the nature of the vuln), could open up tons of internet systems to rtm-style worms.

I emphasize could - but come on, the reality of the story linked from this headline is that it's way less severe - maybe just some spam-related consequences.

A better headline: "ruby mail agent vulnerable, affects rails" ... or something...

This is where having a centralized gem repository might come in handy... If you have 15 projects, you're going to have to go update each and every one.

Usually you do a bundle install when deploying. If you've specified >= 2.2.14 in your Gemfile you just have to redeploy: "cap deploy".

Thanks to user wycats (+team) for bundler. :)

So you still have to redeploy all your 15 projects, as opposed to just fetching the new gem.

You'll also have to do 'bundle update <broken-gem>', commit the resulting Gemfile.lock and hopefully wait for your CI build to pass before deploying. Doing that 15 times would be onerous.

Reply on news.ycombinator.com