🚨 [security] [ruby] Update puma: 3.12.1 → 3.12.2 (patch) #347

depfu · 2019-12-06T09:19:04Z

🚨 Your version of puma has known security vulnerabilities 🚨

Advisory: CVE-2019-16770
Disclosed: December 05, 2019
URL: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994

Keepalive thread overload/DoS in puma

A poorly-behaved client could use keepalive requests to monopolize
Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are
threads available, additional connections will wait permanently if
the attacker sends requests frequently enough.

🚨

We recommend to merge and deploy this update as soon as possible!

🚨

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ puma (3.12.1 → 3.12.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)


        Update puma to version 3.12.2

codecov · 2019-12-06T09:20:58Z

Codecov Report

Merging #347 into master will not change coverage.
The diff coverage is n/a.

@@          Coverage Diff           @@
##           master    #347   +/-   ##
======================================
  Coverage    89.4%   89.4%           
======================================
  Files          35      35           
  Lines         623     623           
======================================
  Hits          557     557           
  Misses         66      66

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d29049e...f850acc. Read the comment docs.

Update puma to version 3.12.2

Verified

This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.

GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits

Loading status checks…

f850acc

depfu bot added the depfu label Dec 6, 2019

depfu bot changed the title ~~[ruby] Update puma: 3.12.1 → 3.12.2 (patch)~~ 🚨 [security] [ruby] Update puma: 3.12.1 → 3.12.2 (patch) Dec 6, 2019

depfu bot deleted the depfu/update/puma-3.12.2 branch Dec 6, 2019

Please note that GitHub no longer supports your web browser.

archivesunleashed/auk

🚨 [security] [ruby] Update puma: 3.12.1 → 3.12.2 (patch) #347

🚨 [security] [ruby] Update puma: 3.12.1 → 3.12.2 (patch) #347

depfu bot commented Dec 6, 2019 •

edited

This comment has been minimized.

codecov bot commented Dec 6, 2019 •

edited

Please note that GitHub no longer supports your web browser.

archivesunleashed/auk

Join GitHub today

🚨 [security] [ruby] Update puma: 3.12.1 → 3.12.2 (patch) #347

Conversation

depfu bot commented Dec 6, 2019 • edited

What changed?

✳️ puma (3.12.1 → 3.12.2) · Repo · Changelog

This comment has been minimized.

codecov bot commented Dec 6, 2019 • edited

Codecov Report

depfu bot commented Dec 6, 2019 •

edited

codecov bot commented Dec 6, 2019 •

edited