SUSE Security Update: Security update for rubygem-puma
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:2060-1
Rating:             important
References:         #1158675 #1165402 #1172175 #1172176 
Cross-References:   CVE-2019-16770 CVE-2020-11076 CVE-2020-11077
                    CVE-2020-5247
Affected Products:
                    SUSE OpenStack Cloud 6-LTSS
______________________________________________________________________________

   An update that fixes four vulnerabilities is now available.

Description:

   This update for rubygem-puma fixes the following issues:

   - Add patches for disabling TLSv1.0 and TLSv1.1 (jsc#SLE-6965):
   - Add CVE-2020-11077.patch (bsc#1172175, CVE-2020-11077)
   - Add CVE-2020-11076.patch (bsc#1172176, CVE-2020-11076)
   - Add CVE-2020-5247.patch (bsc#1165402) "Fixes a problem where we were not
     splitting newlines in headers according to Rack spec" The patch is
     reduced compared to the upstream version, which was patching also the
     parts that are not implemented in our old Puma version. This applies to
     unit test as well.
   - Add CVE-2019-16770.patch (bsc#1158675, SOC-10999, CVE-2019-16770) This
     patch fixes a DoS vulnerability a malicious client could use to block a
     large amount of threads.


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud 6-LTSS:

      zypper in -t patch SUSE-OpenStack-Cloud-6-LTSS-2020-2060=1



Package List:

   - SUSE OpenStack Cloud 6-LTSS (x86_64):

      ruby2.1-rubygem-puma-2.16.0-4.3.1
      ruby2.1-rubygem-puma-debuginfo-2.16.0-4.3.1
      rubygem-puma-debugsource-2.16.0-4.3.1


References:

   https://www.suse.com/security/cve/CVE-2019-16770.html
   https://www.suse.com/security/cve/CVE-2020-11076.html
   https://www.suse.com/security/cve/CVE-2020-11077.html
   https://www.suse.com/security/cve/CVE-2020-5247.html
   https://bugzilla.suse.com/1158675
   https://bugzilla.suse.com/1165402
   https://bugzilla.suse.com/1172175
   https://bugzilla.suse.com/1172176

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2020:2060-1 important: rubygem-puma

July 28, 2020
An update that fixes four vulnerabilities is now available

Summary

This update for rubygem-puma fixes the following issues: - Add patches for disabling TLSv1.0 and TLSv1.1 (jsc#SLE-6965): - Add CVE-2020-11077.patch (bsc#1172175, CVE-2020-11077) - Add CVE-2020-11076.patch (bsc#1172176, CVE-2020-11076) - Add CVE-2020-5247.patch (bsc#1165402) "Fixes a problem where we were not splitting newlines in headers according to Rack spec" The patch is reduced compared to the upstream version, which was patching also the parts that are not implemented in our old Puma version. This applies to unit test as well. - Add CVE-2019-16770.patch (bsc#1158675, SOC-10999, CVE-2019-16770) This patch fixes a DoS vulnerability a malicious client could use to block a large amount of threads. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6-LTSS: zypper in -t patch SUSE-OpenStack-Cloud-6-LTSS-2020-2060=1 Package List: - SUSE OpenStack Cloud 6-LTSS (x86_64): ruby2.1-rubygem-puma-2.16.0-4.3.1 ruby2.1-rubygem-puma-debuginfo-2.16.0-4.3.1 rubygem-puma-debugsource-2.16.0-4.3.1

References

#1158675 #1165402 #1172175 #1172176

Cross- CVE-2019-16770 CVE-2020-11076 CVE-2020-11077

CVE-2020-5247

Affected Products:

SUSE OpenStack Cloud 6-LTSS

https://www.suse.com/security/cve/CVE-2019-16770.html

https://www.suse.com/security/cve/CVE-2020-11076.html

https://www.suse.com/security/cve/CVE-2020-11077.html

https://www.suse.com/security/cve/CVE-2020-5247.html

https://bugzilla.suse.com/1158675

https://bugzilla.suse.com/1165402

https://bugzilla.suse.com/1172175

https://bugzilla.suse.com/1172176

Severity
Announcement ID: SUSE-SU-2020:2060-1
Rating: important

Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved