- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2398-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                          Abhijith PA
October 07, 2020                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : puma
Version        : 3.6.0-1+deb9u1
CVE ID         : CVE-2020-11076 CVE-2020-11077

Several security vulnerabilities have been discovered in puma, highly
concurrent HTTP server for Ruby/Rack applications.

CVE-2020-11076

    By using an invalid transfer-encoding header, an attacker could smuggle
    an HTTP response.

CVE-2020-11077

    client could smuggle a request through a proxy, causing the proxy to
    send a response back to another unknown client. If the proxy uses
    persistent connections and the client adds another request in via HTTP
    pipelining, the proxy may mistake it as the first request's body. Puma,
    however, would see it as two requests, and when processing the second
    request, send back a response that the proxy does not expect. If the
    proxy has reused the persistent connection to Puma to send another
    request for a different client, the second response from the first
    client will be sent to the second client.

For Debian 9 stretch, this problem has been fixed in version
3.6.0-1+deb9u1.

We recommend that you upgrade your puma packages.

For the detailed security status of puma please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/puma

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS