[SECURITY] Fedora 36 Update: rubygem-puma-5.5.2-3.fc36
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-52d0032596
2022-09-07 10:43:58.599476
--------------------------------------------------------------------------------
Name : rubygem-puma
Product : Fedora 36
Version : 5.5.2
Release : 3.fc36
URL : http://puma.io
Summary : A simple, fast, threaded, and highly concurrent HTTP 1.1 server
Description :
Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for
Ruby/Rack applications. Puma is intended for use in both development and
production environments. It's great for highly concurrent Ruby implementations
such as Rubinius and JRuby as well as as providing process worker support to
support CRuby well.
--------------------------------------------------------------------------------
Update Information:
* Fix CVE-2022-23634 - information leak between requests. * Fix CVE-2022-24790 -
http request smuggling vulnerabilities.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 29 2022 V��t Ondruch <vondruch(a)redhat.com> - 5.5.2-3
- Fix CVE-2022-23634 - information leak between requests.
Resolves: rhbz#2054212
- Fix CVE-2022-24790 - http request smuggling vulnerabilities.
Resolves: rhbz#2071616
- Disable sd_notify which appears causing issues with mock + nspawn.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2054211 - CVE-2022-23634 rubygem-puma: rubygem-rails: information leak
between requests
https://bugzilla.redhat.com/show_bug.cgi?id=2054211
[ 2 ] Bug #2071616 - CVE-2022-24790 puma-5.6.4: http request smuggling vulnerabilities
https://bugzilla.redhat.com/show_bug.cgi?id=2071616
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-52d0032596' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------