-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2398-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Abhijith PA October 07, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : puma Version : 3.6.0-1+deb9u1 CVE ID : CVE-2020-11076 CVE-2020-11077 Several security vulnerabilities have been discovered in puma, highly concurrent HTTP server for Ruby/Rack applications. CVE-2020-11076 By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response. CVE-2020-11077 client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. For Debian 9 stretch, this problem has been fixed in version 3.6.0-1+deb9u1. We recommend that you upgrade your puma packages. For the detailed security status of puma please refer to its security tracker page at: https://security-tracker.debian.org/tracker/puma Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAl99oTUACgkQhj1N8u2c KO9RBg//dlVOP41CgoUs7hdfJDc8m3t68cFVatVq+0nXIO/ip/s7AlsTO1T/5yOU pKEUnLifkfuC1GGZ/l0F5FyaqKnwFzqVCgwCzl3y2S+AdmlbDrSqL+s+OgBvVZWs prespWiJMlkpdw1VkVj0tLYikrwBcVDdHEp+21ZKz2muTdNOqaHbqapbL2aGm7tn ZX3uVyN4J++f06hpfgsqrQnFxNxannm308gIicAvI4hb6nQy1qzJK9iR3v3r0rYH l9NPddVtTIXBurOLWjPrjGb7yjPaWrxSWg7kK38BiO6t1lvCqg0UL1xbDL2xHGwO fy/Qi+ccfrxjOc+nqXOIaZojXlntot8Nm7IHproKNN+JbtyOYreKRfh6ogIb0zhf PDtoNWVMQIqVF05lIaWY5PfljoOq9mIhojSRwU/RdaZPZWjQ0WJMkGYxIkphiSq0 fRU90q6P2gjwJ0MbEW/xMASkQSDb9cG5qTHH2q12RHjg0QjlMrMwTy98hIlM+/KT e755avOAzIHg/uBnNjK2+mu5MxJvB1g+tOEDhp6jPRraqPtFySV0MA6F2P0Ljz4s DqulOQhnhYpK1m8Aqfyn4eBNWv3uwYXgIMVB4S60NMg4HwlfdP8Auvh+ILeEJAJP qvAyW5s/+O2YRIpzzjGvQhtCX5c9Zk5MILsloJ4BroGNg6cfMsA= =BPss -----END PGP SIGNATURE-----