SUSE-SU-2022:3571-1

Details

This update for rubygem-puma fixes the following issues:

Updated to version 4.3.12:

CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant (bsc#1197818).

Affected Packages

ruby2.5-rubygem-puma

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

4.3.12-150000.3.9.1

rubygem-puma

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

4.3.12-150000.3.9.1

ruby2.5-rubygem-puma-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

4.3.12-150000.3.9.1

References

REPORT

https://bugzilla.suse.com/1197818

WEB

https://www.suse.com/security/cve/CVE-2022-24790

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20223571-1/