- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3083-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 28, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : puma Version : 3.12.0-2+deb10u3 CVE ID : CVE-2021-29509 CVE-2021-41136 CVE-2022-23634 CVE-2022-24790 Multiple security issues have been found in puma, a web server for ruby/rack applications. CVE-2021-29509 Keepalive Connections Causing Denial Of Service in puma. CVE-2021-41136 puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. CVE-2022-23634 puma may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. CVE-2022-24790 using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma For Debian 10 buster, these problems have been fixed in version 3.12.0-2+deb10u3. We recommend that you upgrade your puma packages. For the detailed security status of puma please refer to its security tracker page at: https://security-tracker.debian.org/tracker/puma Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS