Search for packages
| purl | pkg:deb/debian/puma@3.12.0-2%2Bdeb10u2 |
| Next non-vulnerable version | 5.6.5-3+deb12u1 |
| Latest non-vulnerable version | 5.6.5-3+deb12u1 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5zm7-c7nu-quad
Aliases: CVE-2021-41136 GHSA-48w2-rm65-62xx |
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. |
Affected by 3 other vulnerabilities. |
|
VCID-ap87-c4dc-zfcy
Aliases: CVE-2020-5249 GHSA-33vf-4xgg-9r58 |
HTTP Response Splitting (Early Hints) in Puma ### Impact If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting). While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), which fixed this vulnerability but only for regular responses. ### Patches This has been fixed in 4.3.3 and 3.12.4. ### Workarounds Users can not allow untrusted/user input in the Early Hints response header. ### For more information If you have any questions or comments about this advisory: * Open an issue in [puma](https://github.com/puma/puma) * Email us a project maintainer. [Email addresses are listed in our Code of Conduct](https://github.com/puma/puma/blob/master/CODE_OF_CONDUCT.md#enforcement). |
Affected by 3 other vulnerabilities. |
|
VCID-bk4b-h5hu-2qeq
Aliases: CVE-2020-11077 GHSA-w64w-qqph-5gxm |
HTTP Smuggling via Transfer-Encoding Header in Puma ### Impact This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. ### Patches The problem has been fixed in Puma 3.12.6 and Puma 4.3.5. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy) |
Affected by 3 other vulnerabilities. |
|
VCID-euqw-bed6-z7d6
Aliases: CVE-2020-11076 GHSA-x7jg-6pwg-fx5h |
HTTP Smuggling via Transfer-Encoding Header in Puma ### Impact By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling) Originally reported by @ZeddYu, who has our thanks for the detailed report. ### Patches The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy) |
Affected by 3 other vulnerabilities. |
|
VCID-gkf9-7a9x-nkh4
Aliases: CVE-2022-24790 GHSA-h99w-9q5r-gjq9 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. |
Affected by 3 other vulnerabilities. |
|
VCID-jwun-grgg-2uet
Aliases: CVE-2022-23633 CVE-2022-23634 GHSA-rmj8-8hhh-gv5h GHSA-wh98-p28r-vrc9 |
Exposure of information in Action Pack Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests. This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used. |
Affected by 3 other vulnerabilities. |
|
VCID-nxhw-rdtz-zyar
Aliases: CVE-2024-21647 GHSA-c2f4-cvqm-65w2 |
Puma HTTP Request/Response Smuggling vulnerability ### Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ### Patches The vulnerability has been fixed in 6.4.2 and 5.6.8. ### Workarounds No known workarounds. ### References * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling) * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy) |
Affected by 0 other vulnerabilities. |
|
VCID-pr2m-wx1b-hqbz
Aliases: CVE-2020-5247 GHSA-84j7-475p-hp8v |
HTTP Response Splitting in Puma In Puma (RubyGem) before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters. |
Affected by 3 other vulnerabilities. |
|
VCID-pvph-c6vu-qkhn
Aliases: CVE-2024-45614 GHSA-9hf4-67fc-4vf4 |
Puma's header normalization allows for client to clobber proxy set headers ### Impact Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack. ### Patches v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. ### Workarounds Nginx has a [underscores_in_headers](https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers) configuration variable to discard these headers at the proxy level. Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions. |
Affected by 0 other vulnerabilities. |
|
VCID-q37p-vzmm-aken
Aliases: CVE-2021-29509 GHSA-q28m-8xjw-8vr5 |
Puma's Keepalive Connections Causing Denial Of Service This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994). ### Impact The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. ### Patches This problem has been fixed in `puma` 4.3.8 and 5.3.1. ### Workarounds Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))). The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma). * To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy) ### Acknowledgements Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier. |
Affected by 3 other vulnerabilities. |
|
VCID-tsrb-zgtb-8ybu
Aliases: CVE-2019-16770 GHSA-7xx3-m584-x994 |
## Keepalive thread overload/DoS ### Impact A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. ### Patches This vulnerability is patched in Puma 4.3.1 and 3.12.2. ### Workarounds Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool. ### For more information If you have any questions or comments about this advisory: * Open an issue at [puma](github.com/puma/puma). |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||