“uninitialized constant REXML::VERSION” with Rails 2.1.1 and Rails 2.2 10 Sep 08

We’ve found a minor problem with Rails 2.1.1 (and Rails 2.2) on our Brightboxes.

Because we use Ubuntu Dapper, which ships with Ruby 1.8.4, it includes an earlier version of the REXML library (for XML processing). As you may know, there was a recent security vulnerability to do with the REXML library and these latest two versions of Rails include a fix for this.

Unfortunately, the library that ships with 1.8.4 is slightly incorrect. Ruby conventions state that a constant should be all capitals so, quite rightly, the Rails updates check for a constant called REXML::VERSION. However, in 1.8.4, the constant is actually called REXML::Version meaning that Rails falls over with an “uninitialized constant REXML::VERSION” error.

The quick fix is to manually edit /usr/lib/ruby/1.8/rexml/rexml.rb and add a new (correctly named constant). You will need to use sudo to edit the file, as it is owned by root; after editing the file should look something like: 


module REXML
        Copyright = "Copyright © 2001, 2002, 2003, 2004 Sean Russell <ser@germane-software.com>"
        Date = "2005/224"
        Version = "3.1.3"
        VERSION = "3.1.3"
end

We are also looking at our options for a permanent fix for this issue.

Posted 10 September 2008 by Rahoul Baruah

+ + + +

6 Comments

  1. 3 months ago Simon Russell said:

    We’ve been using Ruby 1.8.6 on Brightbox — 1.8.4 is far too old. The best fix for this bug would be to use Ruby Enterprise Edition — you guys could do a build and give people a tgz, it’s pretty straightforward to setup. It would also possibly be handy if this was on the initial VM images (along with Passenger) — although perhaps it is now?

  2. 3 months ago Rahoul Baruah said:

    We’ve been looking at Passenger, but we’re not sure how we’re going to proceed with it yet.

    Our overall strategy is to stay in sync with Ubuntu - so Dapper boxes use 1.8.4, Hardy boxes use 1.8.6. That way, Canonical maintain the security updates (apt-get update and apt-get upgrade to keep you up to date).

    In return we are working on getting a full Rails stack included in Ubuntu by default - so it’s in our interests to keep things as standard as possible.

    Of course, none of this stops people from choosing to alter things themselves, as you have done.

  3. 3 months ago Zaphod Beeblebrox said:

    Thank you for these clarifications, I solved the problem by compiling the correct version of ruby ;-)

    wget ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6.tar.gz && \
    tar -zxf ruby-1.8.6.tar.gz && \
    cd ruby-1.8.6/ && \
    ./configure && \
    make && \
    sudo make install

  4. 3 months ago uninitialized constant REXML::VERSION said:

    [...] Y todo volver

  5. 3 months ago Jörg Battermann said:

    Are new boxes coming with Dapper still or are you using Hardy on these already?

    Cheers,
    -J

  6. 3 months ago Rahoul Baruah said:

    New boxes will be Hardy - there should be some news on that in the next few days.

Post your comment