Search for packages
| purl | pkg:gem/gitlab-puma@4.3.3.gitlab.2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bk4b-h5hu-2qeq
Aliases: CVE-2020-11077 GHSA-w64w-qqph-5gxm |
HTTP Smuggling via Transfer-Encoding Header in Puma ### Impact This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. ### Patches The problem has been fixed in Puma 3.12.6 and Puma 4.3.5. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy) |
Affected by 4 other vulnerabilities. |
|
VCID-euqw-bed6-z7d6
Aliases: CVE-2020-11076 GHSA-x7jg-6pwg-fx5h |
HTTP Smuggling via Transfer-Encoding Header in Puma ### Impact By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling) Originally reported by @ZeddYu, who has our thanks for the detailed report. ### Patches The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy) |
Affected by 4 other vulnerabilities. |
|
VCID-fhu7-fyha-9khj
Aliases: CVE-2023-40175 GHSA-68xg-gqqm-vgj8 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-gkf9-7a9x-nkh4
Aliases: CVE-2022-24790 GHSA-h99w-9q5r-gjq9 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. | There are no reported fixed by versions. |
|
VCID-jwun-grgg-2uet
Aliases: CVE-2022-23633 CVE-2022-23634 GHSA-rmj8-8hhh-gv5h GHSA-wh98-p28r-vrc9 |
Exposure of information in Action Pack Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests. This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used. | There are no reported fixed by versions. |
|
VCID-q37p-vzmm-aken
Aliases: CVE-2021-29509 GHSA-q28m-8xjw-8vr5 |
Puma's Keepalive Connections Causing Denial Of Service This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994). ### Impact The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. ### Patches This problem has been fixed in `puma` 4.3.8 and 5.3.1. ### Workarounds Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))). The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma). * To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy) ### Acknowledgements Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||