SUSE-SU-2022:1515-1

Details

Description of the patch:

This update for rubygem-puma fixes the following issues:

rubygem-puma was updated to version 4.3.11:

CVE-2021-29509: Adjusted an incomplete fix for allows Denial of Service (DoS) (bsc#1188527)
CVE-2021-41136: Fixed request smuggling if HTTP header value contains the LF character (bsc#1191681)
CVE-2022-23634: Fixed information leak between requests (bsc#1196222)

Affected Packages

ruby2.5-rubygem-puma

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3openSUSE Leap 15.3

Fixed in:

4.3.11-150000.3.6.2

ruby2.5-rubygem-puma-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

4.3.11-150000.3.6.2

References

ADVISORY

https://bugzilla.suse.com/1188527

ADVISORY

https://bugzilla.suse.com/1191681

ADVISORY