Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.2572
puma security update
26 May 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: puma
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-23634 CVE-2020-5247 CVE-2019-16770
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html
Comment: CVSS (Max): 7.5 CVE-2020-5247 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3023-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
May 26, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : puma
Version : 3.6.0-1+deb9u2
CVE ID : CVE-2019-16770 CVE-2020-5247 CVE-2022-23634
Debian Bug : 946312 952766 1005391
Several security vulnerabilities have been discovered in puma, a web server for
Ruby/Rack applications. These flaws may lead to information leakage due to not
always closing response bodies, allowing untrusted input in a response header
(HTTP Response Splitting) and thus potentially facilitating several other
attacks like cross-site scripting. A poorly-behaved client could also use
keepalive requests to monopolize Puma's reactor and create a denial of service
attack.
For Debian 9 stretch, these problems have been fixed in version
3.6.0-1+deb9u2.
We recommend that you upgrade your puma packages.
For the detailed security status of puma please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/puma
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmKOsqVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeRRPg/9Fzw/hgb0w34a0PmS0Fwo9eiabGeLrr37aCd8d+GK06+B05w7yy6Hh3Tp
Zhe2YTS1bZkB8GDOKXMPkdjCNeywd1EGHq7pxX4o0uo0ewQutSQC90CvFTy3saEe
gIhxRWqux6udxzi+mF3yQ+rtO3VClDTL0NM/DWdRQccHU4E52JqSTqA9XAIgDEtU
bOFuEEk0wy3lGBuDQhOZPM30DR4xwtZUZKTOGdgTfSNCFLiJIpbYUBous3HcF7FY
IVqbhqmO3qeWynzlFCqtRFG0ByCqdP9kZlG3EdT51MmIDJx9PN5yAUG0FycKgKD1
Bzg+Jt4k7bgsn5To6TvNvjYe+r6rpW23/afBegdv9X5NWXwLcI7+KC8fL2etSoo0
5zDjJ5A1AWioVQDnTKu5kjKdDa5BFzml45lNKWJY4X+nvqsrCl6EC95dW0PtIPSd
64rh3QkNax0HgV4f3v7Z7KHpGtSiZZz0IIJWK36C32j0J1/pymkyPyP1I8OMUpWX
y0t1djj7yuXJxsmlMbCAu5iapO3CrohdLTzLiKZuXAxVnelhxUSdcLj2JRNKD3en
GtmKFHO05zGCZUiZRuDduyACHtfWZOkGjCZd/naQlCfS43PgcNbVaYVErb+20eyW
l8TCoIoDPmWhTpxSHFlcEL6IQge6nJ27FSDlOzIwwFsSB0W35e4=
=TNx2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYo8R3ckNZI30y1K9AQhhexAAqsMANOfEDBL/mDcy+xbA8tPsAn/NdjC/
WHlpP9mVwZ2su+z0HKMdlQqYu3EuSWdcFaDKQKUylmCOze3H2Ks5E32GEqkITRR5
hioK+rF8cMzsBR2hm+cBU+svAIgv03eFnpfimAoRicvfbwFhXaC7NOUMIIe9cixK
CdpWw0tNyc1QzIXqeX7/nmrD7syXaaY1Lob6gJsDJOMQY7QZ4SSdhkI3fLukXAaO
BXWagVx39smO+kf71h6ZTpqltvXqdfc0PVyL0b7HBoXXe1P6geD2KvfF6TuASIlM
Vyn/SiU8Q6k0AAt/LJyNkZlb+e4MwZTDvJwkcx2X2yX71AAqmLobRYEsCQ5qFTKO
eGtx0PmzipLEGKSL5lGNzO0DyRluc/yBZOikjBHuKhEb5gc6yHchwECQdodiKMd4
Oj+8Qc1n9TLsNdPD4P8AWt9FB6hRRoAV/2e8hy8M+W6VyHOMy55Hx/WPqKnOGUL7
l/XUv6yUGuhnBJ3jOOU8uqcDxIYn5rnUzveCrOHFDUP9M/VPIaz7zLleBIUuqNcY
lLBa99cNweBag5C07LmvIFUsny3ry6+6GbmyvQ8cLT57VyoCYPJCoSyeamZtmAEG
fL4cncWNllnQGqCEYmKHlZBwXSqbcwuI55gyaVgPIkl6AbNesiAcvI215DvlCHP1
AxV548ZrA0g=
=fT59
-----END PGP SIGNATURE-----