Security update for rubygem-puma SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1919-1 Final 1 1 2020-07-15T08:56:27Z current 2020-07-15T08:56:27Z 2020-07-15T08:56:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-puma This update for rubygem-puma to version 4.3.5 fixes the following issues: - CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage (bsc#1172175). - CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header (bsc#1172176). - Disabled TLSv1.0 and TLSv1.1 (jsc#SLE-6965). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-2020-1919,Image SLES15-SAP-Azure-BYOS-2020-1919,Image SLES15-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SAP-EC2-HVM-2020-1919,Image SLES15-SAP-EC2-HVM-BYOS-2020-1919,Image SLES15-SAP-GCE-2020-1919,Image SLES15-SAP-GCE-BYOS-2020-1919,Image SLES15-SAP-OCI-BYOS-2020-1919,Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM-2020-1919,Image SLES15-SP1-CAP-Deployment-BYOS-GCE-2020-1919,Image SLES15-SP1-SAP-Azure-2020-1919,Image SLES15-SP1-SAP-Azure-BYOS-2020-1919,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SP1-SAP-EC2-HVM-2020-1919,Image SLES15-SP1-SAP-EC2-HVM-BYOS-2020-1919,Image SLES15-SP1-SAP-GCE-2020-1919,Image SLES15-SP1-SAP-GCE-BYOS-2020-1919,Image SLES15-SP1-SAP-OCI-BYOS-2020-1919,Image SLES15-SP2-CAP-Deployment-BYOS-Azure-2020-1919,Image SLES15-SP2-SAP-Azure-2020-1919,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SP2-SAP-BYOS-Azure-2020-1919,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2020-1919,Image SLES15-SP2-SAP-BYOS-GCE-2020-1919,Image SLES15-SP2-SAP-EC2-HVM-2020-1919,Image SLES15-SP2-SAP-GCE-2020-1919,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SP3-SAP-BYOS-Azure-2020-1919,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2020-1919,Image SLES15-SP3-SAP-BYOS-GCE-2020-1919,Image SLES15-SP4-SAP-Azure-LI-BYOS-2020-1919,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2020-1919,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SP4-SAP-BYOS-2020-1919,Image SLES15-SP4-SAP-BYOS-Azure-2020-1919,Image SLES15-SP4-SAP-BYOS-EC2-2020-1919,Image SLES15-SP4-SAP-BYOS-GCE-2020-1919,Image SLES15-SP4-SAP-Hardened-2020-1919,Image SLES15-SP4-SAP-Hardened-Azure-2020-1919,Image SLES15-SP4-SAP-Hardened-BYOS-2020-1919,Image SLES15-SP4-SAP-Hardened-BYOS-Azure-2020-1919,Image SLES15-SP4-SAP-Hardened-BYOS-EC2-2020-1919,Image SLES15-SP4-SAP-Hardened-BYOS-GCE-2020-1919,Image SLES15-SP4-SAP-Hardened-EC2-2020-1919,Image SLES15-SP4-SAP-Hardened-GCE-2020-1919,Image SLES15-SP5-SAP-Azure-LI-BYOS-2020-1919,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2020-1919,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2020-1919,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2020-1919,Image SLES15-SP5-SAP-BYOS-Azure-2020-1919,Image SLES15-SP5-SAP-BYOS-EC2-2020-1919,Image SLES15-SP5-SAP-BYOS-GCE-2020-1919,Image SLES15-SP5-SAP-Hardened-Azure-2020-1919,Image SLES15-SP5-SAP-Hardened-BYOS-Azure-2020-1919,Image SLES15-SP5-SAP-Hardened-BYOS-EC2-2020-1919,Image SLES15-SP5-SAP-Hardened-BYOS-GCE-2020-1919,Image SLES15-SP5-SAP-Hardened-EC2-2020-1919,Image SLES15-SP5-SAP-Hardened-GCE-2020-1919,SUSE-2020-1919,SUSE-SLE-Product-HA-15-2020-1919,SUSE-SLE-Product-HA-15-SP1-2020-1919,SUSE-SLE-Product-HA-15-SP2-2020-1919 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201919-1/ Link for SUSE-SU-2020:1919-1 https://lists.suse.com/pipermail/sle-security-updates/2020-July/007132.html E-Mail link for SUSE-SU-2020:1919-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172175 SUSE Bug 1172175 https://bugzilla.suse.com/1172176 SUSE Bug 1172176 https://www.suse.com/security/cve/CVE-2020-11076/ SUSE CVE CVE-2020-11076 page https://www.suse.com/security/cve/CVE-2020-11077/ SUSE CVE CVE-2020-11077 page Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM Image SLES15-SP1-CAP-Deployment-BYOS-GCE Image SLES15-SP1-SAP-Azure Image SLES15-SP1-SAP-Azure-BYOS Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-EC2-HVM Image SLES15-SP1-SAP-EC2-HVM-BYOS Image SLES15-SP1-SAP-GCE Image SLES15-SP1-SAP-GCE-BYOS Image SLES15-SP1-SAP-OCI-BYOS Image SLES15-SP2-CAP-Deployment-BYOS-Azure Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-EC2 Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-EC2 Image SLES15-SP5-SAP-Hardened-GCE SUSE Linux Enterprise High Availability Extension 15 SUSE Linux Enterprise High Availability Extension 15 SP1 SUSE Linux Enterprise High Availability Extension 15 SP2 ruby2.5-rubygem-puma-4.3.5-3.3.1 ruby2.5-rubygem-puma-doc-4.3.5-3.3.1 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-Azure-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-GCE-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SAP-OCI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-EC2-HVM-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-GCE-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP1-SAP-OCI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-CAP-Deployment-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP2-SAP-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-BYOS-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP4-SAP-Hardened-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-BYOS-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-Azure ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-EC2 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of Image SLES15-SP5-SAP-Hardened-GCE ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of SUSE Linux Enterprise High Availability Extension 15 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP1 ruby2.5-rubygem-puma-4.3.5-3.3.1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. CVE-2020-11076 Image SLES15-SAP-Azure-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-EC2-HVM-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-GCE-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-OCI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-CAP-Deployment-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-GCE-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-OCI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-CAP-Deployment-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-puma-4.3.5-3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201919-1/ https://www.suse.com/security/cve/CVE-2020-11076.html CVE-2020-11076 https://bugzilla.suse.com/1172175 SUSE Bug 1172175 https://bugzilla.suse.com/1172176 SUSE Bug 1172176 In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5. CVE-2020-11077 Image SLES15-SAP-Azure-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-EC2-HVM-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-GCE-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SAP-OCI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-CAP-Deployment-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-EC2-HVM-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-GCE-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP1-SAP-OCI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-CAP-Deployment-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP2-SAP-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP3-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP4-SAP-Hardened:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-EC2:ruby2.5-rubygem-puma-4.3.5-3.3.1 Image SLES15-SP5-SAP-Hardened-GCE:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-puma-4.3.5-3.3.1 SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-puma-4.3.5-3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201919-1/ https://www.suse.com/security/cve/CVE-2020-11077.html CVE-2020-11077 https://bugzilla.suse.com/1172175 SUSE Bug 1172175 https://bugzilla.suse.com/1172176 SUSE Bug 1172176