Package Instance

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response
back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP
pipelining, the proxy may mistake it as the first request's body. Puma, however,
would see it as two requests, and when processing the second request, send back
a response that the proxy does not expect. If the proxy has reused the persistent
connection to Puma to send another request for a different client, the second response
from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

By using an invalid transfer-encoding header, an attacker could
[smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Keepalive Connections Causing Denial Of Service in puma
### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected
existing connections that had already been accepted from having their
requests starved by greedy persistent-connections saturating all threads in
the same process. However, new connections may still be starved by greedy
persistent-connections saturating all threads in all processes in the
cluster.

A puma server which received more concurrent keep-alive connections than the
server had threads in its threadpool would service only a subset of
connections, denying service to the unserved connections.

### Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

### Workarounds

Setting queue_requests false also fixes the issue. This is not advised when
using puma without a reverse proxy, such as nginx or apache, because you will
open yourself to slow client attacks (e.g. [slowloris][1]).

The fix is very small. [A git patch is available here][2] for those using
[unsupported versions][3] of Puma.

[1]: https://en.wikipedia.org/wiki/Slowloris_(computer_security)
[2]: https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837
[3]: https://github.com/puma/puma/security/policy#supported-versions

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.