Package Instance

Keepalive thread overload/DoS in puma
A poorly-behaved client could use keepalive requests to monopolize
Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are
threads available, additional connections will wait permanently if
the attacker sends requests frequently enough.

HTTP Response Splitting (Early Hints) in Puma
### Impact
If an application using Puma allows untrusted input in an early-hints header,
an attacker can use a carriage return character to end the header and inject
malicious content, such as additional headers or an entirely new response body.
This vulnerability is known as [HTTP Response
Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)

While not an attack in itself, response splitting is a vector for several other
attacks, such as cross-site scripting (XSS).

This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v),
which fixed this vulnerability but only for regular responses.

### Patches
This has been fixed in 4.3.3 and 3.12.4.

### Workarounds
Users can not allow untrusted/user input in the Early Hints response header.

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response
back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP
pipelining, the proxy may mistake it as the first request's body. Puma, however,
would see it as two requests, and when processing the second request, send back
a response that the proxy does not expect. If the proxy has reused the persistent
connection to Puma to send another request for a different client, the second response
from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

HTTP Smuggling via Transfer-Encoding Header in Puma
### Impact

By using an invalid transfer-encoding header, an attacker could
[smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Puma's header normalization allows for client to clobber proxy set headers
### Impact

Clients could clobber values set by intermediate proxies (such as
X-Forwarded-For) by providing a underscore version of the same
header (X-Forwarded_For).

Any users trusting headers set by their proxy may be affected.
Attackers may be able to downgrade connections to HTTP (non-SSL)
or redirect responses, which could cause confidentiality leaks
if combined with a separate MITM attack.

### Patches
v6.4.3/v5.6.9 now discards any headers using underscores if the
non-underscore version also exists.  Effectively, allowing the
proxy defined headers to always win.

### Workarounds
Nginx has a [underscores_in_headers](https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers)
configuration variable to discard these headers at the proxy level.

Any users that are implicitly trusting the proxy defined headers
for security or availability should immediately cease doing so
until upgraded to the fixed versions.

Keepalive Connections Causing Denial Of Service in puma
### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected
existing connections that had already been accepted from having their
requests starved by greedy persistent-connections saturating all threads in
the same process. However, new connections may still be starved by greedy
persistent-connections saturating all threads in all processes in the
cluster.

A puma server which received more concurrent keep-alive connections than the
server had threads in its threadpool would service only a subset of
connections, denying service to the unserved connections.

### Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

### Workarounds

Setting queue_requests false also fixes the issue. This is not advised when
using puma without a reverse proxy, such as nginx or apache, because you will
open yourself to slow client attacks (e.g. [slowloris][1]).

The fix is very small. [A git patch is available here][2] for those using
[unsupported versions][3] of Puma.

[1]: https://en.wikipedia.org/wiki/Slowloris_(computer_security)
[2]: https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837
[3]: https://github.com/puma/puma/security/policy#supported-versions

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.