Debian: DLA-2398-1 Critical: Puma HTTP Smuggling Issues

CVE-2020-11076

By using an invalid transfer-encoding header, an attacker could smuggle
an HTTP response.

CVE-2020-11077

client could smuggle a request through a proxy, causing the proxy to
send a response back to another unknown client. If the proxy uses
persistent connections and the client adds another request in via HTTP
pipelining, the proxy may mistake it as the first request's body. Puma,
however, would see it as two requests, and when processing the second
request, send back a response that the proxy does not expect. If the
proxy has reused the persistent connection to Puma to send another
request for a different client, the second response from the first
client will be sent to the second client.

For Debian 9 stretch, this problem has been fixed in version
3.6.0-1+deb9u1.

We recommend that you upgrade your puma packages.

For the detailed security status of puma please refer to
its security tracker page at: