[USN-6682-1] Puma vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEhC9y9XdAFQPCvYXchGmXSGiknnUFAmXp4ucFAwAAAAAACgkQhGmXSGiknnXT
ug/+IGt2rXMSBi3aSYoTgltKzpEAIbn/ZMdCnWQYDbyTAvz3I7aUWaPHRN2o+wjdoYiGvFjQhvFH
GK8zA3jNgNeMEEi5s3wSwnUSczNyYLNYP6p0ysKsnfkOaTf9ixjboysTM+UpFlzXyscIFQ+y1U30
AUyiXBrqzHl46yrJhIup449JE2PcQV/Oy8VomGMD+6Jlll5bgVqHaKyImkwN0gETg341PluQ4Xza
87wdyJNjcK8LqMJR5b2LzN9tFd5Z/vncpS8EBuM/lBVlTxUyKHRtM0BPJF2xRLxnrqVnZXHrN1Ll
+sbeKMqo767XH3HrfOcyLs9QWwUVh2eKTgeolA0ExMssWoSdBYcEsJrtfZV8LlZfjBQf51HK0jKz
9AXQKlvzTYbQDPDeYewAixxt7D+zIpQRjnuOQNZeCFCxCn3b8VzvmkVvpRYT5OFRS1D7xkLJwO8S
ePUI1ajMlTc6A8p6obK22o/boABUOIa3HFNEpIbLfQ/Ln+CbL2pTICYSnT9K6/ENp/+cHgC/sz68
TSds0i0ABcRVMiVTVwPITffTS7nArGLhBpZEyY4eottW6iElWZ9qyT4sotvZKugnCuLN/1wPEjsO
qm7p24ntteP3fYs99GUCIBUnvmoLzwDHoa5FSfirpDMxT4Xl9cAMJNEEIHxANZXXdVkpYDNZ1Hjx
9zY=
=u7l2
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6682-1
March 07, 2024

puma vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in Puma.

Software Description:
- puma: threaded HTTP 1.1 server for Ruby/Rack applications

Details:

ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could possibly use this issue to perform an HTTP Request
Smuggling attack. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-11076)

It was discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could possibly use this issue to perform an HTTP Request
Smuggling attack. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-11077)

Jean Boussier discovered that Puma might not always release resources
properly after handling HTTP requests. A remote attacker could possibly
use this issue to read sensitive information. (CVE-2022-23634)

It was discovered that Puma incorrectly handled certain malformed headers.
A remote attacker could use this issue to perform an HTTP Request Smuggling
attack. (CVE-2022-24790)

Ben Kallus discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could use this issue to perform an HTTP Request Smuggling
attack. (CVE-2023-40175)

Bartek Nowotarski discovered that Puma incorrectly handled parsing certain
encoded content. A remote attacker could possibly use this to cause a
denial of service. (CVE-2024-21647)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS (Available with Ubuntu Pro):
puma 5.5.2-2ubuntu2+esm1

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
puma 3.12.4-1ubuntu2+esm1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6682-1
CVE-2020-11076, CVE-2020-11077, CVE-2022-23634, CVE-2022-24790,
CVE-2023-40175, CVE-2024-21647