search

medusa-project / book-tracker

Medusa Book Tracker
0 stars 0 forks source link

Resolve Puma HTTP Request/Response Smuggling vulnerability #48

Closed gaurijo closed 10 months ago

gaurijo commented 10 months ago

Dependabot Alert - Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches The vulnerability has been fixed in 6.4.2 and 5.6.8.

gaurijo commented 10 months ago

@adolski I saw a dependabot alert about the puma gem and just wanted to document it as its own issue here for reference.

Is it fine for me to push up an update of the gem (and make sure the update doesn't break any existing dependencies) or do you prefer I checkout a separate branch for this?

adolski commented 10 months ago

It's fine to work directly on the main branches for this. Thanks!