🚨 [security][ruby] 업데이트 puma:4.3.3→ 4.3.6(패치)

묘사

🚨 현재 의존 항목에 알려진 보안 결함이 있습니다🚨
이 의존 항목 업데이트는 이미 알려진 보안 빈틈을 복구했습니다.아래의 상세한 정보를 보고 그 영향을 자세히 평가해 주십시오.우리는 가능한 한 빨리 그것을 합병하고 배치할 것을 건의합니다.
다음은 업데이트에 대해 알아야 할 모든 정보입니다.이 요청을 통합하기 전에 변경된 내용과 테스트 결과를 자세히 보십시오.

뭐가 바뀌었어?

✳️ 퓨마(4.3.3)→ 4.3.6)·환매·변경기록

안전 자문🚨

🚨 Puma에서 전송 코딩 헤더를 통해 HTTP 밀수

영향

By using an invalid transfer-encoding header, an attacker could
smuggle an HTTP response.

헝<unk>을 깁다

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

🚨 Puma에서 전송 코딩 헤더를 통해 HTTP 밀수

영향

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response
back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP
pipelining, the proxy may mistake it as the first request's body. Puma, however,
would see it as two requests, and when processing the second request, send back
a response that the proxy does not expect. If the proxy has reused the persistent
connection to Puma to send another request for a different client, the second response
from the first client will be sent to the second client.

헝<unk>을 깁다

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

릴리즈 노트

4.3.6

v4.3.5...4.3.6

A quick fix for a build error on Mac OS and a JSON require fix for those using phased restart.

• Explicitly include ctype.h to fix compilation warning and build error on macOS with Xcode 12 (#2304)
• Don't require json at boot (#2269)

이게 틀린 것 같나요?Please let us know.
언약
See the full diff on Github . 새 릴리즈에서는 다음과 같은 8가지 차이점이 있습니다.

v4.3.6

Merge pull request #2314 from venables/fix-include

Merge pull request #2269 from MSP-Greg/json-require

Bump version

Adjust test to match real world value

Reduce ambiguity of headers

Bump version

Better handle client input

Depfu 분기에 커밋을 추가하지 않는 한 이 PR이 충돌하지 않도록 자동으로 유지됩니다.@depfu rebase 주석을 사용하여 수동으로 터치할 수도 있습니다.
모든 Depfu 주석 명령

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

토론 #1

#231에 유리합니다.