SUSE-SU-2022:3571-1

Details

Description of the patch:

This update for rubygem-puma fixes the following issues:

Updated to version 4.3.12:

CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant (bsc#1197818).

Affected Packages

ruby2.5-rubygem-puma

SUSE Linux Enterprise High Availability Extension 15SUSE Linux Enterprise High Availability Extension 15 SP1SUSE Linux Enterprise High Availability Extension 15 SP2SUSE Linux Enterprise High Availability Extension 15 SP3SUSE Linux Enterprise High Availability Extension 15 SP4

Fixed in:

4.3.12-150000.3.9.1

ruby2.5-rubygem-puma-doc

openSUSE Leap 15.3openSUSE Leap 15.4

Fixed in:

4.3.12-150000.3.9.1

References

ADVISORY

https://bugzilla.suse.com/1197818

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2022-October/012533.html

ADVISORY

https://www.suse.com/security/cve/CVE-2022-24790/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20223571-1/