huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-12254: python: Unbounded memory buffering in SelectorSocketTransport.writelines()
Component: python
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-06T15:19:41.576000+00:00

A flaw was found in Python. In certain configurations, the `asyncio._SelectorSocketTransport.writelines()` method fails to signal the protocol to clear the write buffer when it approaches capacity. Because of this, protocols would not periodically drain the write buffer, potentially leading to a denial of service via memory exhaustion.

Statement: This vulnerability likely impacts a small number of users. You must be using Python 3.12.0 or later, on Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true, then your usage of Python is unaffected.


This vulnerability is rated with an Important severity due to its potential for denial of service (DoS) attacks through memory exhaustion. By failing to signal the protocol to drain the write buffer when approaching the high-water mark, the affected `asyncio._SelectorSocketTransport.writelines()` method introduces a important flaw in flow control. This flaw can lead to uncontrolled growth of the buffer in long-running or high-throughput applications, which are typical in networked systems or event-driven architectures. Given that `asyncio` is widely used in performance-critical Python applications for handling asynchronous I/O, the impact of memory exhaustion could destabilize services, compromise system availability, and increase the risk of cascading failures, especially in production environments handling large-scale or untrusted inputs.

Affected upstream versions: 3.12.0 < 3.12.9, 3.13.0 < 3.13.2, 3.14.0a1 < 3.14.0a3
Fixed upstream versions: v3.13.2
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 71e8429ac8e2adc10084ab5ec29a62f4b6671a82
CVE-2024-1233: EAP: wildfly-elytron has a SSRF security issue
Component: EAP
Severity: Moderate
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2024-04-02T00:00:00+00:00

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.

Statement: The SSRF vulnerability in JwtValidator.resolvePublicKey is considered a moderate severity issue due to its potential to allow unauthorized internal network access and exposure of sensitive information, albeit with certain constraints. The vulnerability leverages the absence of URL whitelisting or filtering when resolving the jku header, which can be exploited to make HTTP requests to arbitrary URLs. While the immediate impact might not directly compromise sensitive data or system integrity, it opens a pathway for attackers to discover and interact with internal services, potentially leading to further exploitation. The exploitation complexity and the need for an attacker to craft a malicious JWT token mitigate the severity to a moderate level, as it requires a certain degree of knowledge and capability to execute effectively.

Affected upstream versions: <= 31.0.0.Final
Fixed upstream versions: 0:1.0.12-1.Final_redhat_00001.1.ep7.el7, 0:1.0.12-6.Final_redhat_00001.1.ep7.el7, 0:1.0.13-1.Final_redhat_00001.1.ep7.el7, 0:1.0.21-1.Final_redhat_00001.1.ep7.el7, 0:1.1.14-1.Final_redhat_00001.1.ep7.el7, 0:1.1.17-1.Final_redhat_00002.1.el8eap, 0:1.1.17-1.Final_redhat_00002.1.el9eap, 0:1.1.19-1.Final_redhat_00001.1.el8eap, 0:1.1.19-1.Final_redhat_00001.1.el9eap, 0:1.10.0-36.Final_redhat_00035.1.el8eap, 0:1.10.0-36.Final_redhat_00035.1.el9eap, 0:1.10.17-1.Final_redhat_00001.1.el7eap, 0:1.12.3-3.Final_redhat_00001.1.el8eap, 0:1.12.3-3.Final_redhat_00001.1.el9eap, 0:1.15.23-2.Final_redhat_00001.1.el7eap, 0:1.15.23-2.Final_redhat_00001.1.el8eap, 0:1.15.23-2.Final_redhat_00001.1.el9eap, 0:1.2.4-1.Final_redhat_00001.1.el8eap, 0:1.2.4-1.Final_redhat_00001.1.el9eap, 0:1.4.18-16.SP14_redhat_00001.1.ep7.el7
Upstream repository: https://github.com/wildfly/wildfly
Upstream fix commit: 0c02350bc0d84287bed46e7c32f90b36e50d3523
CVE-2024-12369: elytron-oidc-client: OIDC Authorization Code Injection
Component: elytron-oidc-client
Severity: Moderate
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2024-12-09T00:00:00+00:00

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

Statement: Red Hat has evaluated this vulnerability. This affects the OIDC Client when using RHSSO OIDC Adapter with EAP 7.x or elytron-oidc-client with EAP 8.x.

Affected upstream versions: <= 2.6.1.Final
Fixed upstream versions: 0:2.2.9-1.Final_redhat_00001.1.el8eap, 0:2.2.9-1.Final_redhat_00001.1.el9eap
Upstream repository: https://github.com/wildfly-security/wildfly-elytron
Upstream fix commit: 5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb
CVE-2024-12718: cpython: python: Bypass extraction filter to modify file metadata outside extraction directory
Component: cpython
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L)
Public date: 2025-06-03T12:59:10.908000+00:00

A flaw was found in CPython's tarfile module. This vulnerability allows modification of file metadata, such as timestamps or permissions, outside the intended extraction directory via maliciously crafted tar archives using the filter="data" or filter="tar" extraction filters.

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of such access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.11.0 < 3.11.13, 3.12.0 < 3.12.11, 3.13.0 < 3.13.4, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 3612d8f51741b11f36f8fb0494d79086bac9390a
CVE-2024-12797: openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected
Component: openssl
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-02-11T15:00:00+00:00

A flaw was found in OpenSSL's RFC7250 Raw Public Key (RPK) authentication. This vulnerability allows man-in-the-middle (MITM) attacks via failure to abort TLS/DTLS handshakes when the server's RPK does not match the expected key despite the SSL_VERIFY_PEER verification mode being set.

Statement: This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2, which was first shipped in RHEL 9.5. Earlier releases of OpenSSL provided in RHEL prior to 9.5 are not affected. 

RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. 

Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected.

rhel9/ruby-33 & ubi9/ruby-33 are not affected because RPK is not present in any form or as any function that could be called from Ruby via Red Hat supported RPMs in RHEL. For example the SSL_dane_enable or SSL_add_expected_rpk or X509_STORE_CTX_get0_rpk or X509_STORE_CTX_init_rpk (and more rpk-related) functions are not callable from Ruby.

Affected upstream versions: 3.4.0 < 3.4.1, 3.3.0 < 3.3.3, 3.2.0 < 3.2.4
Fixed upstream versions: 3.2.4, 3.3.3, 3.4.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 738d4f9fdeaad57660dcba50a619fafced3fd5e9
CVE-2024-12905: tar-fs: link following and path traversal via maliciously crafted tar file
Component: tar-fs
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2025-03-27T16:25:34.410000+00:00

A flaw was found in the tar-fs package for Node.js. In affected versions, unauthorized file writes or overwrites outside the intended extraction directory can occur when extracting a maliciously crafted tar file. The issue is associated with index.js in the tar-fs package.

Statement: This vulnerability is rated as an important severity because it allows attackers to extract a malicious tar file that can write or overwrite files outside the intended directory. This occurs due to improper handling of link resolution and pathname limitations. The risk is high for systems that automatically extract tar files, as it can lead to data corruption or unauthorized file modifications without user interaction.

Affected upstream versions: 0.0.0 < 1.16.4, 2.0.0 < 2.1.2, 3.0.0 < 3.0.8
Fixed upstream versions: 1.16.4, 2.1.2, 3.0.8
Upstream repository: https://github.com/mafintosh/tar-fs
Upstream fix commit: a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed
CVE-2024-1394: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
Component: golang-fips/openssl
Severity: Important
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-20T00:00:00+00:00

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

Statement: The majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a "Moderate" level of impact.

Affected upstream versions: <= v2.0.0
Fixed upstream versions: 0:0.16.0-2.2.rhaos4.12.el8, 0:0.19.0-1.3.rhaos4.14.el8, 0:0.19.0-1.4.rhaos4.14.el8, 0:0.2.1-3.el8ost, 0:0.2.1-3.el9ost, 0:0.20.0-1.1.rhaos4.15.el8, 0:1.19.13-6.el7_9, 0:1.19.13-7.el9_2, 0:1.20.12-2.el9_3, 0:1.21.9-2.el9_4, 0:1.25.0-2.2.el8, 0:1.25.3-5.2.rhaos4.12.git44a2cb2.el9, 0:1.26.0-4.1.el8, 0:1.26.5-11.1.rhaos4.13.git919cc6e.el8, 0:1.27.0-3.1.el8, 0:1.27.0-3.2.el8, 0:1.27.4-6.1.rhaos4.14.gitd09e4c0.el8, 0:1.27.4-7.2.rhaos4.14.git082c52f.el8, 0:1.28.0-3.1.el8, 0:1.28.4-8.rhaos4.15.git24f50b9.el8
Upstream repository: https://github.com/golang-fips/openssl
Upstream fix commit: 85d31d0d257ce842c8a1e63c4d230ae850348136
CVE-2024-21489: uplot: Prototype Pollution in uplot
Component: uplot
Severity: Important
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
Public date: 2024-10-01T05:15:12.227000+00:00

A flaw was found in uPlot. This vulnerability allows prototype pollution via the uplot.assign function due to missing checks for attributes that resolve to the object prototype.

Statement: Grafana is not impacted by this CVE, as the vulnerable `uplot.assign` function is not utilized in Grafana on Red Hat Enterprise Linux. Only RHEL-8.4.z having the issue.

Affected upstream versions: <= 1.6.30
Fixed upstream versions: 1.6.31
Upstream repository: https://github.com/leeoniya/uPlot
Upstream fix commit: 5756e3e9b91270b303157e14bd0174311047d983
CVE-2024-21501: sanitize-html: Information Exposure when used on the backend
Component: sanitize-html
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2024-02-24T00:00:00+00:00

An information exposure flaw was found in the sanitize-html package, when used on the backend with the style attribute allowed. This issue may allow an attacker to enumerate files in the system, including project dependencies, to gather details about the file system structure and dependencies of the targeted server.


Affected upstream versions: <= 2.11.0
Fixed upstream versions: *, 2.12.1
Upstream repository: https://github.com/apostrophecms/sanitize-html
Upstream fix commit: c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
CVE-2024-21503: psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file
Component: psf/black
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-19T00:00:00+00:00

The python-black package is susceptible to a regular expression denial of service (ReDoS) vulnerability, found in the lines_with_leading_tabs_expanded() function within the strings.py file. This vulnerability could be exploited by running Black on untrusted input or by inserting numerous leading tab characters into docstrings. This flaw allows attackers to craft malicious input to trigger a denial of service.


Affected upstream versions: <= 24.2.0
Fixed upstream versions: 24.3.0
Upstream repository: https://github.com/psf/black
Upstream fix commit: f00093672628d212b8965a8993cee8bedf5fe9b8
CVE-2024-21520: djangorestframework: Cross-site Scripting (XSS) via break_long_headers
Component: djangorestframework
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-06-26T00:00:00+00:00

A vulnerability was found in the djangorestframework package. Cross-site scripting occurs via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.


Affected upstream versions: <= 3.15.1
Fixed upstream versions: 3.15.2
Upstream repository: https://github.com/encode/django-rest-framework
Upstream fix commit: 3b41f0124194430da957b119712978fa2266b642
CVE-2024-21529: dset: Prototype Pollution
Component: dset
Severity: Important
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
Public date: 2024-09-11T05:15:02.547000+00:00

A flaw was found in the dset package. Affected versions of this package are vulnerable to Prototype Pollution via the dset function due to improper user input sanitization. This vulnerability allows the attacker to inject a malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program.

Statement: Prototype Pollution is rated with as Important severity issue because it exploits the fundamental inheritance mechanism of JavaScript objects, allowing an attacker to maliciously alter the global Object.prototype. This can lead to widespread and unpredictable behavior across the entire application, as all objects inherit from this polluted prototype. The consequences can range from denial of service (DoS), where important functions like toString() are rendered unusable, to remote code execution (RCE), where injected properties are executed in privileged contexts.


rhdh-hub-container 1.2 include the patch for this vulnerability starting at 1.2.5

Affected upstream versions: <= v3.1.3
Fixed upstream versions: 3.1.4
Upstream repository: https://github.com/lukeed/dset
Upstream fix commit: 16d6154e085bef01e99f01330e5a421a7f098afa
CVE-2024-21534: jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
Component: jsonpath-plus
Severity: Low
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-10-11T05:00:01.824000+00:00

A flaw was found in jsonpath-plus. This vulnerability allows remote code execution via improper input sanitisation and unsafe default usage of the vm module in Node.js. Attackers can exploit this by executing arbitrary code through the unsafe use of the vm module in Node.js, which allows for malicious code injection. This issue occurs due to the way jsonpath-plus evaluates JSON paths using vm, a Node.js module that allows code execution. If user input is not properly sanitized, an attacker can craft JSON paths that execute dangerous commands, such as reading sensitive files.

Statement: Red Hat's initial impact rating of critical has been downgraded to low. While the vulnerable code is technically still present within Red Hat products, there are no code paths in affected products which allow exploitation. As such, the impact to Red Hat products is low.

Each of the products listed have multiple components where a fixed build could occur. This distinction does not matter for users as only one build needs fixed for the product. Additionally, in Red Hat OpenShift AI, jsonpath-plus is a dependency of a direct dependency and is never loaded, as the direct dependency's feature that requires jsonpath-plus is not used.

Affected upstream versions: <= v9.0.0
Fixed upstream versions: *
Upstream repository: https://github.com/JSONPath-Plus/JSONPath
Upstream fix commit: 6b2f1b4c234292c75912b790bf7e2d7339d4ccd3
CVE-2024-21536: http-proxy-middleware: Denial of Service
Component: http-proxy-middleware
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-19T05:00:04.056000+00:00

A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain paths.


Affected upstream versions: 3.0.0 < 3.0.3
Fixed upstream versions: 2.0.7, 3.0.3
Upstream repository: https://github.com/chimurai/http-proxy-middleware
Upstream fix commit: 0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5
CVE-2024-21538: cross-spawn: regular expression denial of service
Component: cross-spawn
Severity: Low
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-11-08T05:00:04.695000+00:00

A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.


Affected upstream versions: 7.0.0 < 7.0.5, 7.0.2 < 7.0.6
Fixed upstream versions: 6.0.6, 7.0.5, 7.0.6
Upstream repository: https://github.com/moxystudio/node-cross-spawn
Upstream fix commit: 5ff3a07d9add449021d806e45c4168203aa833ff
CVE-2024-21626: runc: file descriptor leak
Component: runc
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2024-01-31T20:01:00+00:00

A file descriptor leak issue was found in the runc package. While a user performs `O_CLOEXEC` all file descriptors before executing the container code, the file descriptor is open when performing `setcwd(2)`, which means that the reference can be kept alive in the container by configuring the working directory to be a path resolved through the file descriptor. The non-dumpable bit is unset after `execve`, meaning there are multiple ways to attack this other than bad configurations. The only way to defend against it entirely is to close all unneeded file descriptors.

Statement: These vulnerabilities not only enable malicious actors to escape containerized environments but also allow for full control over the underlying host system. With the widespread adoption of containerization technologies in both development and production environments, such exploits pose significant risks to data integrity, confidentiality, and system stability.

OpenShift Container Platform ships with SELinux in targeted enforcing mode, which prevents the container processes from accessing host content and mitigates this attack, and disabling SELinux on the Openshift container platform is not supported. Hence, the impact of the Openshift Container Platform is reduced to Moderate.

For multicluster-engine (MCE) vulnerable versions of buildkit and runc are part of installed version of oc. However, they are not affecting the higher-level assisted-installer binary in MCE. The presence of these dependencies in the container does not imply a security risk to the containerized application itself, as it is based on low-level packages included in the oc binary, and the impact to the container's core functionality is minimal.

This flaw doesn't affect the OpenShift Tools & Services as the affected code is only used for testing and is not exposed to the final user.

Affected upstream versions: >=v1.0.0-rc93, < 1.1.12
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 02120488a4c0fc487d1ed2867e901eeed7ce8ecf
CVE-2024-21647: rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies
Component: rubygem-puma
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-08T00:00:00+00:00

A flaw was found in Puma rubygem. Versions prior 6.4.2 are susceptible to a HTTP smuggling attack when parsing chunked transfer encoding bodies on HTTP messages, which don't limit the size of the message chunk extensions. This issue may lead to uncontrolled resource consumption, possibly resulting in a denial of service of the attacked server.

Statement: For Red Hat Satellite the affected version of the package tfm-rubygem-puma applies to EL7 only, which means it only applies to Satellite 6.11 on RHEL 7 which is currently out of support.

Affected upstream versions: < 5.6.8, >= 6.0.0, < 6.4.2
Fixed upstream versions: v6.4.2
Upstream repository: https://github.com/puma/puma
Upstream fix commit: 5fc43d73b6ff193325e657a24ed76dec79133e93