Headline
CVE-2021-29509: puma | RubyGems.org | your community gem host
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma
server which received more concurrent keep-alive
connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma
4.3.8 and 5.3.1. Setting queue_requests false
also fixes the issue. This is not advised when using puma
without a reverse proxy, such as nginx
or apache
, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.
puma 5.6.5
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It’s great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Runtime Dependencies (1):
- nio4r ~> 2.0
Owners:
Pushed by:
Authors:
- Evan Phoenix
SHA 256 checksum:
661029d15a115e9f6c0641a69c830ffd9f1b9ac63fcd0791d94ccd900e03f863
Total downloads 228,432,227****For this version 181,316
**Gemfile:
= Copy to clipboard Copied!
****install:
=
****License:
BSD-3-Clause
****Required Ruby Version: >= 2.2****Links:**
Related news
Gentoo Linux Security Advisory 202208-28 - Multiple vulnerabilities have been discovered in Puma, the worst of which could result in denial of service. Versions less than 5.6.4 are affected.
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.