Bug 836431 (CVE-2022-24790)

Summary:	<www-servers/puma-5.6.4: multiple http request smuggling vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	ruby
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/puma/puma/releases/tag/v5.6.4
Whiteboard:	B4 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	837581
Bug Blocks:

Description John Helmert III archtester

2022-03-30 14:59:19 UTC

From URL: "Close several HTTP Request Smuggling exploits (CVE-2022-24790)"

Please bump to 5.6.4.

Comment 1 Hans de Graaff gentoo-dev

2022-03-31 06:15:44 UTC

Puma 5.6.4 has been added.

Comment 2 John Helmert III archtester

2022-03-31 14:05:10 UTC

Thanks! Please stabilize when ready

Comment 3 John Helmert III archtester

2022-04-12 14:09:48 UTC

Please cleanup

Comment 4 Hans de Graaff gentoo-dev

2022-04-12 17:29:51 UTC

Cleanup done.

Comment 5 John Helmert III archtester

2022-08-14 05:05:19 UTC

GLSA request filed

Comment 6 Larry the Git Cow gentoo-dev

2022-08-14 21:43:33 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=74f54f14d9074878f0b2b711ab3064799b15e9cb

commit 74f54f14d9074878f0b2b711ab3064799b15e9cb
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-14 21:41:58 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-14 21:43:20 +0000

    [ GLSA 202208-28 ] Puma: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/794034
    Bug: https://bugs.gentoo.org/817893
    Bug: https://bugs.gentoo.org/833155
    Bug: https://bugs.gentoo.org/836431
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-28.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

Comment 7 Sam James archtester

2022-08-14 21:44:26 UTC

GLSA done, all done.