Debian LTS: Security Advisory for puma (DLA-3023-1)

The remote host is missing an update for the 'puma' package(s) announced via the DLA-3023-1 advisory.

Several security vulnerabilities have been discovered in puma, a web server for Ruby/Rack applications. These flaws may lead to information leakage due to not always closing response bodies, allowing untrusted input in a response header (HTTP Response Splitting) and thus potentially facilitating several other attacks like cross-site scripting. A poorly-behaved client could also use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

'puma' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 3.6.0-1+deb9u2. We recommend that you upgrade your puma packages.