From cdee1782ef4dc31aa7bb2aa9636c80c433d28392 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 11 Oct 2024 13:36:21 -0300 Subject: [PATCH] Update dependency puma to v6.4.3 [SECURITY] (#396) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | puma | `6.4.2` -> `6.4.3` | [![age](https://developer.mend.io/api/mc/badges/age/rubygems/puma/6.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/puma/6.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/puma/6.4.2/6.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/puma/6.4.2/6.4.3?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-45614](https://redirect.github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4) ### Impact Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack. ### Patches v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. ### Workarounds Nginx has a [underscores_in_headers](https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers) configuration variable to discard these headers at the proxy level. Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions. --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/powerhome/audiences). --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Carlos Palhares --- audiences/Gemfile.lock | 3 ++- audiences/gemfiles/rails_6_1.gemfile.lock | 3 ++- audiences/gemfiles/rails_7_0.gemfile.lock | 3 ++- audiences/gemfiles/rails_7_1.gemfile.lock | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/audiences/Gemfile.lock b/audiences/Gemfile.lock index 43b088c1..310bed85 100644 --- a/audiences/Gemfile.lock +++ b/audiences/Gemfile.lock @@ -143,7 +143,7 @@ GEM psych (5.1.2) stringio public_suffix (5.0.5) - puma (6.4.2) + puma (6.4.3) nio4r (~> 2.0) racc (1.8.1) rack (2.2.9) @@ -290,6 +290,7 @@ GEM PLATFORMS arm64-darwin-22 arm64-darwin-23 + arm64-darwin-24 x86_64-linux DEPENDENCIES diff --git a/audiences/gemfiles/rails_6_1.gemfile.lock b/audiences/gemfiles/rails_6_1.gemfile.lock index fec26e94..a32fc04a 100644 --- a/audiences/gemfiles/rails_6_1.gemfile.lock +++ b/audiences/gemfiles/rails_6_1.gemfile.lock @@ -143,7 +143,7 @@ GEM psych (5.1.2) stringio public_suffix (6.0.0) - puma (6.4.2) + puma (6.4.3) nio4r (~> 2.0) racc (1.8.0) rack (2.2.9) @@ -281,6 +281,7 @@ GEM PLATFORMS arm64-darwin-22 arm64-darwin-23 + arm64-darwin-24 x86_64-linux DEPENDENCIES diff --git a/audiences/gemfiles/rails_7_0.gemfile.lock b/audiences/gemfiles/rails_7_0.gemfile.lock index 952b170a..e93a78ed 100644 --- a/audiences/gemfiles/rails_7_0.gemfile.lock +++ b/audiences/gemfiles/rails_7_0.gemfile.lock @@ -149,7 +149,7 @@ GEM psych (5.1.2) stringio public_suffix (6.0.0) - puma (6.4.2) + puma (6.4.3) nio4r (~> 2.0) racc (1.8.0) rack (2.2.9) @@ -280,6 +280,7 @@ GEM PLATFORMS arm64-darwin-22 arm64-darwin-23 + arm64-darwin-24 x86_64-linux DEPENDENCIES diff --git a/audiences/gemfiles/rails_7_1.gemfile.lock b/audiences/gemfiles/rails_7_1.gemfile.lock index 246dc3cc..cbaa4edb 100644 --- a/audiences/gemfiles/rails_7_1.gemfile.lock +++ b/audiences/gemfiles/rails_7_1.gemfile.lock @@ -161,7 +161,7 @@ GEM psych (5.1.2) stringio public_suffix (6.0.0) - puma (6.4.2) + puma (6.4.3) nio4r (~> 2.0) racc (1.8.0) rack (3.1.7) @@ -298,6 +298,7 @@ GEM PLATFORMS arm64-darwin-23 + arm64-darwin-24 x86_64-linux DEPENDENCIES