USN-7031-2: Puma vulnerability
USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS. This update fixes the CVE for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to overwrite header values set by intermediate proxies by providing duplicate headers containing underscore characters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7031-2?
USN-7031-2 addresses a medium severity security vulnerability in the Puma web server.
How do I fix USN-7031-2?
To fix USN-7031-2, update the Puma package to version 5.5.2-2ubuntu2+esm2 for Ubuntu 22.04 or version 3.12.4-1ubuntu2+esm2 for Ubuntu 20.04.
What versions of Ubuntu are affected by USN-7031-2?
USN-7031-2 affects Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.
What issue does USN-7031-2 address?
USN-7031-2 addresses a vulnerability where Puma incorrectly handled parsing certain headers, potentially allowing remote attacks.
Is it necessary to update Puma for Ubuntu 24.04 LTS if USN-7031-2 is already addressed?
No, USN-7031-2 is specifically for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS, so no further action is required for Ubuntu 24.04 LTS regarding this vulnerability.