-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2022-52d0032596 2022-09-07 10:43:58.599476 --------------------------------------------------------------------------------
Name : rubygem-puma Product : Fedora 36 Version : 5.5.2 Release : 3.fc36 URL : http://puma.io Summary : A simple, fast, threaded, and highly concurrent HTTP 1.1 server Description : Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
-------------------------------------------------------------------------------- Update Information:
* Fix CVE-2022-23634 - information leak between requests. * Fix CVE-2022-24790 - http request smuggling vulnerabilities. -------------------------------------------------------------------------------- ChangeLog:
* Mon Aug 29 2022 V��t Ondruch vondruch@redhat.com - 5.5.2-3 - Fix CVE-2022-23634 - information leak between requests. Resolves: rhbz#2054212 - Fix CVE-2022-24790 - http request smuggling vulnerabilities. Resolves: rhbz#2071616 - Disable sd_notify which appears causing issues with mock + nspawn. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2054211 - CVE-2022-23634 rubygem-puma: rubygem-rails: information leak between requests https://bugzilla.redhat.com/show_bug.cgi?id=2054211 [ 2 ] Bug #2071616 - CVE-2022-24790 puma-5.6.4: http request smuggling vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=2071616 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-52d0032596' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------