{"id":"CVE-2022-23634","aliases":["DEBIAN-CVE-2022-23634","DLA-3023-1","DLA-3083-1","DSA-5146-1","EUVD-2022-1175","GHSA-rmj8-8hhh-gv5h","OESA-2024-1002","OESA-2024-1003","OESA-2024-1004","OESA-2024-1005","OESA-2024-1006","OESA-2024-1007","RHSA-2022:5498","RLSA-2022:5498","SUSE-SU-2022:1515-1","UBUNTU-CVE-2022-23634","USN-6682-1","openSUSE-SU-2024:11847-1","openSUSE-SU-2024:12900-1","openSUSE-SU-2024:13720-1","openSUSE-SU-2025:15123-1","openSUSE-SU-2026:10357-1"],"status":"published","title":"Information Exposure when using Puma with Rails","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02107,"percentile":0.81888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-404"],"published":"2022-02-11T21:33:23Z","modified":"2026-11-03T08:01:03Z","fixes":[{"ecosystem":"RubyGems","package":"puma","fixed_in":["5.6.2","4.3.11"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"puma","fixed_in":["5.6.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"puma","fixed_in":["5.6.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"puma","fixed_in":["5.6.4-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-puma","fixed_in":["5.5.2-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-puma","fixed_in":["3.12.6-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-puma","fixed_in":["3.12.6-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-puma","fixed_in":["3.12.6-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-puma","fixed_in":["5.5.2-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"puma","fixed_in":["3.12.4-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"puma","fixed_in":["5.5.2-2ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.6.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb9u2"}]}],"versions":["3.6.0-1","3.6.0-1+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-2+deb10u3"}]}],"versions":["3.12.0-2","3.12.0-2+deb10u1","3.12.0-2+deb10u2"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.8-1+deb11u2"}]}],"versions":["4.3.8-1","4.3.8-1+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"RubyGems","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.6.2"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.1","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.4.0","5.5.0","5.5.1","5.5.2","5.6.0","5.6.1"]},{"source":"osv","ecosystem":"RubyGems","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11"}]}],"versions":["0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0.0","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","2.0.0","2.0.0.b1","2.0.0.b2","2.0.0.b3","2.0.0.b4","2.0.0.b5","2.0.0.b6","2.0.0.b7","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.1","2.12.2","2.12.3","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.14.0","2.15.0","2.15.1","2.15.2","2.15.3","2.16.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.9.0","2.9.1","2.9.2","3.0.0","3.0.0.rc1","3.0.1","3.0.2","3.1.0","3.1.1","3.10.0","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.4","3.12.5","3.12.6","3.2.0","3.3.0","3.4.0","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.6.2","3.7.0","3.7.1","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1","4.0.0","4.0.1","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","4.3.1","4.3.10","4.3.3","4.3.4","4.3.5","4.3.6","4.3.7","4.3.8","4.3.9"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.6-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.6-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.6-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.6-3.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el7pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el7pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.13-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.13-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.10-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-2.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-2.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python38-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python38-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.4.7-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.4.7-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.10-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.28-42.el8_4"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150000.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1ubuntu2+esm1"}]}],"versions":["3.12.0-2ubuntu1","3.12.0-4ubuntu1","3.12.4-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-2ubuntu2+esm1"}]}],"versions":["4.3.6-1ubuntu4","5.5.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1ubuntu2+esm1"}]}],"versions":["3.12.0-2ubuntu1","3.12.0-4ubuntu1","3.12.4-1ubuntu2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2-2ubuntu2+esm1"}]}],"versions":["4.3.6-1ubuntu4","5.5.2-2ubuntu2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3-1.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3-1.5"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"puma","product":"puma"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-rmj8-8hhh-gv5h","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/advisories/GHSA-wh98-p28r-vrc9","tags":["x_refsource_MISC","x_transferred","Mitigation","Not Applicable","Third Party Advisory","advisory","report"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email\u0026utm_source=footer\u0026pli=1","tags":["x_refsource_MISC","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","web","report"]},{"url":"https://www.debian.org/security/2022/dsa-5146","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/202208-28","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23634","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2022-23634.yml","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23634.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23634","tags":["advisory"]},{"url":"https://github.com/puma/puma","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1002","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1003","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1004","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1005","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41136","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1007","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5498","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1609543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1662924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1825761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1851808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867193","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1869351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1877283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1893059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1899481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1911545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1914803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1923766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1957070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1957288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1960228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1972501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2008809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054758","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2067301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2067331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2079357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096921","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5498.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3200","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3584","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21295","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21409","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-30151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30151","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-grh7-935j-hg6w","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32839","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32839","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41136","tags":["advisory"]},{"url":"https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42550","tags":["advisory"]},{"url":"http://logback.qos.ch/news.html","tags":["article"]},{"url":"https://cve.report/CVE-2021-42550","tags":["article"]},{"url":"https://jira.qos.ch/browse/LOGBACK-1591","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43797","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818","tags":["advisory"]},{"url":"https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44420","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/dec/07/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44568","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45115","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/jan/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45452","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23633","tags":["advisory"]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23634","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23833","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23837","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23837","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jrfj-98qg-qjgv","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28346","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/apr/11/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28347","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28347","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5498","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188527","tags":["report"]},{"url":"https://bugzilla.suse.com/1191681","tags":["report"]},{"url":"https://bugzilla.suse.com/1196222","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23634","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23634","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6682-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-11076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-21647","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11076","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4HTCFDLUCKJZXX35RHXSTQHMCPIT5GOW/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45614","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-23634","title":"Information Exposure when using Puma with Rails","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T21:40:11Z","modified":"2025-04-23T19:05:33.266Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-1175","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T21:40:11Z","modified":"2025-04-23T19:05:33Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:06.891582Z"}],"ghsa":[{"id":"GHSA-rmj8-8hhh-gv5h","title":"Puma used with Rails may lead to Information Exposure","description":"### Impact\nPrior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.\n\nFrom Rails:\n\n\u003e Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.\n\nThe combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.\n\n### Patches\nThis problem is fixed in Puma versions 5.6.2 and 4.3.11.\n\nThis problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\nSee: \nhttps://github.com/advisories/GHSA-wh98-p28r-vrc9 \nfor details about the rails vulnerability\n\nUpgrading to a patched Rails _or_ Puma version fixes the vulnerability.\n\n### Workarounds\n\nUpgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\nThe [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email\u0026utm_source=footer\u0026pli=1) includes a middleware that can be used instead.\n\n### References\n\n* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email\u0026utm_source=footer\u0026pli=1)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [puma](https://github.com/puma/puma)\n* See our [security policy](https://github.com/puma/puma/security/policy)","status":"published","published":"2022-02-11T21:33:23Z","modified":"2023-07-13T19:09:16Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200","CWE-404"],"updated_at":"2026-11-02T14:36:57.310051Z"}],"nvd":[{"id":"CVE-2022-23634","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T22:15:07.817Z","modified":"2026-06-17T04:30:31.703Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-404"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"CVE-2022-23634","title":"Information Exposure when using Puma with Rails","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T21:40:11Z","modified":"2026-10-28T02:30:35.833625632Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-23634","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T22:15:07.817Z","modified":"2026-11-03T08:01:03.786261213Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-rmj8-8hhh-gv5h","title":"Puma used with Rails may lead to Information Exposure","description":"### Impact\nPrior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.\n\nFrom Rails:\n\n\u003e Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.\n\nThe combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.\n\n### Patches\nThis problem is fixed in Puma versions 5.6.2 and 4.3.11.\n\nThis problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\nSee: \nhttps://github.com/advisories/GHSA-wh98-p28r-vrc9 \nfor details about the rails vulnerability\n\nUpgrading to a patched Rails _or_ Puma version fixes the vulnerability.\n\n### Workarounds\n\nUpgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\nThe [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email\u0026utm_source=footer\u0026pli=1) includes a middleware that can be used instead.\n\n### References\n\n* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email\u0026utm_source=footer\u0026pli=1)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [puma](https://github.com/puma/puma)\n* See our [security policy](https://github.com/puma/puma/security/policy)","status":"published","published":"2022-02-11T21:33:23Z","modified":"2026-02-04T04:40:25.385031Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200","CWE-404"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"OESA-2024-1002","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:07.366634158Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1003","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:07.809888371Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1004","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:07.811047193Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1005","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:07.861160831Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1006","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request\u0026apos;s body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with `puma`.(CVE-2021-41136)\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:11.551979691Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1007","title":"rubygem-puma security update","description":"A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.\r\n\r\nSecurity Fix(es):\r\n\r\nPuma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails\u0026apos; Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.(CVE-2022-23634)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:07.894410779Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2022:5498","title":"Red Hat Security Advisory: Satellite 6.11 Release","status":"published","published":"2024-09-29T19:06:23Z","modified":"2026-10-13T10:03:09Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"UBUNTU-CVE-2022-23634","description":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","status":"published","published":"2022-02-11T22:15:00Z","modified":"2026-02-04T02:56:09.278657Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3023-1","title":"puma - security update","status":"published","published":"2022-05-26T00:00:00Z","modified":"2026-03-09T01:19:30.478804Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3083-1","title":"puma - security update","status":"published","published":"2022-08-28T00:00:00Z","modified":"2026-03-09T01:20:58.365317Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5146-1","title":"puma - security update","status":"published","published":"2022-05-24T00:00:00Z","modified":"2026-03-09T02:09:47.089376Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11847-1","title":"ruby3.1-rubygem-puma-5.6.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-puma-5.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:12:47.958966Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12900-1","title":"ruby3.2-rubygem-puma-6.0.0-2.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-puma-6.0.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:31.990602Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13720-1","title":"ruby3.3-rubygem-puma-6.4.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-puma-6.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:10:49.529663Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:15123-1","title":"ruby3.4-rubygem-puma-6.4.3-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-puma-6.4.3-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:37:51.450825Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10357-1","title":"ruby4.0-rubygem-puma-6.4.3-1.5 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-puma-6.4.3-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:44:10.499349Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RLSA-2022:5498","title":"Moderate: Satellite 6.11 Release","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n\n* libsolv: Heap-based buffer overflow in testcase_read() in src/testcase.c (CVE-2021-3200) \n* satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)\n* candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)\n* candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)\n* candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)\n* candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)\n* tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)\n* python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)\n* libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)\n* tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)\n* logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)\n* candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n* python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)\n* python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420)  \n* libsolv: Heap overflow (CVE-2021-44568)\n* python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)\n* tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)\n* tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)\n* python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)\n* tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)\n* python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAdditional Changes:\n\n* New repo layout for Satellite, Utils, Maintenance, and Client repos.\n* Support for Rocky Linux 9 clients\n* Module-based installation on Rocky Linux 8\n* Upgrading Satellite Server and Capsule Server installations from Rocky Linux 7 to Rocky Linux 8\n* Connected and Disconnected servers supported on Rocky Linux 7 and Rocky Linux 8\n* Inter-Server Synchronization improvements\n* Puppet integration optional and disabled by default\n* Pulp 3 updated to Python 3.8\n* Change to Capsule certificate archive\n* New default port for communication with Rocky Enterprise Software Foundation Subscription Management * (RHSM) API on Capsule servers\n* New Content Views Page (Content Publication workflow simplification)\n* New Hosts Page (Technology Preview)\n* Registration and preview templates\n* Simplified host content source changing\n* Improved behavior for configuring and running remote jobs\n* Provisioning improvements\n* New error signaling unsupported options in TASK-Filter\n* Virt-who configuration enhanced to support Nutanix AHV\n* Cloud Connector configuration updated\n* Improved Insights adoption\n\nThe items above are not a complete list of changes. This update also fixes\nseveral bugs and adds various enhancements. Documentation for these changes\nis available from the Release Notes document linked to in the References\nsection.","status":"published","published":"2022-07-05T13:55:16Z","modified":"2026-02-05T04:30:12.09857Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"SUSE-SU-2022:1515-1","title":"Security update for rubygem-puma","description":"This update for rubygem-puma fixes the following issues:\n\nrubygem-puma was updated to version 4.3.11:\n\n* CVE-2021-29509: Adjusted an incomplete fix for  allows Denial of Service (DoS) (bsc#1188527)\n* CVE-2021-41136: Fixed request smuggling if HTTP header value contains the LF character (bsc#1191681)\n* CVE-2022-23634: Fixed information leak between requests (bsc#1196222)\n","status":"published","published":"2022-05-04T08:24:51Z","modified":"2025-05-02T04:31:22.643894Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6682-1","title":"puma vulnerabilities","description":"ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers.\nA remote attacker could possibly use this issue to perform an HTTP Request\nSmuggling attack. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2020-11076)\n\nIt was discovered that Puma incorrectly handled parsing certain headers.\nA remote attacker could possibly use this issue to perform an HTTP Request\nSmuggling attack. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2020-11077)\n\nJean Boussier discovered that Puma might not always release resources\nproperly after handling HTTP requests. A remote attacker could possibly\nuse this issue to read sensitive information. (CVE-2022-23634)\n\nIt was discovered that Puma incorrectly handled certain malformed headers.\nA remote attacker could use this issue to perform an HTTP Request Smuggling\nattack. (CVE-2022-24790)\n\nBen Kallus discovered that Puma incorrectly handled parsing certain headers.\nA remote attacker could use this issue to perform an HTTP Request Smuggling\nattack. (CVE-2023-40175)\n\nBartek Nowotarski discovered that Puma incorrectly handled parsing certain\nencoded content. A remote attacker could possibly use this to cause a\ndenial of service. (CVE-2024-21647)\n","status":"published","published":"2024-03-07T14:00:06Z","modified":"2026-04-27T17:17:23.416530229Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}