puma - security update

Fixed packages 1

Vulnerabilities 4

• Critical 9.1
  CVE-2022-24790

  HTTP Request Smuggling in puma

  Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree o…

  puma puma puma puma Debian Ubuntu RubyGems
  Mar 30, 2022
• High 8.0
  CVE-2022-23634

  Information Exposure when using Puma with Rails

  Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` …

  puma puma puma puma Debian Ubuntu RubyGems
  Feb 11, 2022
• High 7.5
  CVE-2021-29509

  Keepalive Connections Causing Denial Of Service in puma

  Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections…

  puma puma puma puma Debian RubyGems
  May 11, 2021
• Low 3.7
  CVE-2021-41136

  Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

  Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a…

  puma puma puma puma Debian RubyGems
  Oct 12, 2021