Debian Long Term Support / LTS Security Information / 2020 / Security Information -- DLA-2398-1 puma

Debian Security Advisory

DLA-2398-1 puma -- LTS security update

Date Reported:

08 Oct 2020

Affected Packages:

puma

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2020-11076, CVE-2020-11077.

More information:

Several security vulnerabilities have been discovered in puma, highly concurrent HTTP server for Ruby/Rack applications.

• CVE-2020-11076

  By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.

• CVE-2020-11077

  client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

For Debian 9 stretch, this problem has been fixed in version 3.6.0-1+deb9u1.

We recommend that you upgrade your puma packages.

For the detailed security status of puma please refer to its security tracker page at: https://security-tracker.debian.org/tracker/puma

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS