chore(deps): update dependency puma to '~> 6.4.0' [security] #935
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
lodewiges
approved these changes
Nov 27, 2024
DrumsnChocolate
added a commit
that referenced
this pull request
Nov 29, 2024
* chore(deps): update dependency paranoia to v3 (#931) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Edited the env file (#944) * edited the env file * changed company name to UTF-8 * chore(deps): update dependency puma to '~> 6.4.0' [security] (#935) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update actions/delete-package-versions action to v5 (#906) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency rails to v7.0.8.1 [security] (#918) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update docker/build-push-action action to v6 (#928) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update docker/login-action action to v3 (#886) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * feat(tests): add code coverage reporting (#891) * feat(tests): add code coverage reporting * fix: correct coverage path * refactor: use simplecov-lcov * fix: indentation in Gemfile.lock * fix: remove test filters * feat(README): add badge * refactor: try tokenless report uploading * chore: update codecov-action * chore: update codecov-action * fix(cd): pass CODECOV_TOKEN To ci * Revert "chore(deps): update docker/login-action action to v3 (#886)" (#951) This reverts commit d546681. due to CI failure * chore(deps): update codecov/codecov-action action to v5 (#950) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency puma to v6.4.3 [security] (#948) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update actions/upload-artifact action to v4 (#949) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Refractor/tomato to sofia (#947) * Intial commit * updated apliction.rb * Fixed mistake in credentials * Made it so the file is backwards compatiable * Fixed a typo * Update amber_oauth2.rb remove tomato paramater * Remove development title lux ad mosam (#946) * intial commit * Fix typo * update tomato to sofia * updated with suggestion --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: lodewiges <[email protected]> Co-authored-by: Guido de Jong <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'~> 6.1.1'->'~> 6.4.0'GitHub Vulnerability Alerts
CVE-2023-40175
Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
The following vulnerabilities are addressed by this advisory:
Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.
Workarounds
No known workarounds.
References
HTTP Request Smuggling
For more information
If you have any questions or comments about this advisory:
Open an issue in Puma
See our security policy
CVE-2024-21647
Impact
Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.
Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.
Patches
The vulnerability has been fixed in 6.4.2 and 5.6.8.
Workarounds
No known workarounds.
References
CVE-2024-45614
Impact
Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.
Patches
v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.
Workarounds
Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level.
Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Amsterdam, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.