[SECURITY] Fedora 35 Update: rubygem-puma-4.3.6-5.fc35
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-de968d1b6c
2022-09-07 09:56:23.468558
--------------------------------------------------------------------------------
Name : rubygem-puma
Product : Fedora 35
Version : 4.3.6
Release : 5.fc35
URL : http://puma.io
Summary : A simple, fast, threaded, and highly concurrent HTTP 1.1 server
Description :
Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for
Ruby/Rack applications. Puma is intended for use in both development and
production environments. It's great for highly concurrent Ruby implementations
such as Rubinius and JRuby as well as as providing process worker support to
support CRuby well.
--------------------------------------------------------------------------------
Update Information:
* Fix CVE-2022-23634 - information leak between requests. * Fix CVE-2022-24790 -
http request smuggling vulnerabilities
--------------------------------------------------------------------------------
ChangeLog:
* Mon Aug 29 2022 V��t Ondruch <vondruch(a)redhat.com> - 4.3.6-5
- Fix CVE-2022-23634 - information leak between requests.
Resolves: rhbz#2054212
- Fix CVE-2022-24790 - http request smuggling vulnerabilities.
Resolves: rhbz#2071616
- Disable sd_notify which appears causing issues with mock + nspawn.
* Mon Nov 8 2021 V��t Ondruch <vondruch(a)redhat.com> - 4.3.6-5
- Fix FTBFS due to updated RPM.
Resolves: rhbz#1987946
* Fri Jul 23 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.3.6-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Wed Jan 27 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.3.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2054211 - CVE-2022-23634 rubygem-puma: rubygem-rails: information leak
between requests
https://bugzilla.redhat.com/show_bug.cgi?id=2054211
[ 2 ] Bug #2071616 - CVE-2022-24790 puma-5.6.4: http request smuggling vulnerabilities
https://bugzilla.redhat.com/show_bug.cgi?id=2071616
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-de968d1b6c' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------