Linux Security
    Linux Security
    Linux Security

    Debian LTS: DLA-2398-1: puma security update

    Date 07 Oct 2020
    191
    Posted By LinuxSecurity Advisories
    Several security vulnerabilities have been discovered in puma, highly concurrent HTTP server for Ruby/Rack applications. CVE-2020-11076
    
    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-2398-1                This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/lts/security/                          Abhijith PA
    October 07, 2020                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------
    
    Package        : puma
    Version        : 3.6.0-1+deb9u1
    CVE ID         : CVE-2020-11076 CVE-2020-11077
    
    Several security vulnerabilities have been discovered in puma, highly
    concurrent HTTP server for Ruby/Rack applications.
    
    CVE-2020-11076
    
        By using an invalid transfer-encoding header, an attacker could smuggle
        an HTTP response.
    
    CVE-2020-11077
    
        client could smuggle a request through a proxy, causing the proxy to
        send a response back to another unknown client. If the proxy uses
        persistent connections and the client adds another request in via HTTP
        pipelining, the proxy may mistake it as the first request's body. Puma,
        however, would see it as two requests, and when processing the second
        request, send back a response that the proxy does not expect. If the
        proxy has reused the persistent connection to Puma to send another
        request for a different client, the second response from the first
        client will be sent to the second client.
    
    For Debian 9 stretch, this problem has been fixed in version
    3.6.0-1+deb9u1.
    
    We recommend that you upgrade your puma packages.
    
    For the detailed security status of puma please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/puma
    
    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    

    LinuxSecurity Poll

    How long have you been using Linux?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 4 answer(s).
    /main-polls/46-how-long-have-you-been-using-linux?task=poll.vote&format=json
    46
    radio
    [{"id":"160","title":"Just made the switch!","votes":"1","type":"x","order":"1","pct":50,"resources":[]},{"id":"161","title":"1-5 years","votes":"0","type":"x","order":"2","pct":0,"resources":[]},{"id":"162","title":"6-10 years","votes":"0","type":"x","order":"3","pct":0,"resources":[]},{"id":"163","title":">10 years - I'm a veteran!","votes":"1","type":"x","order":"4","pct":50,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.