SB2021050659 - openEuler 20.03 LTS SP1 update for rubygem-puma

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-11076)

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation in the Transfer-Encoding Header. A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-11077)

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1169