CVE-2019-16770
published 2021-05-11CVE-2019-16770: Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.96%
78.1th percentile
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | puma | < puma 4.3.8-1 (bookworm) | puma 4.3.8-1 (bookworm) |
| debian | puma | < puma 3.12.0-4 (bookworm) | puma 3.12.0-4 (bookworm) |
| puma | puma | < 4.3.8 | 4.3.8 |
| puma | puma | < 4.3.8 | 4.3.8 |
| puma | puma | — | — |
| puma | puma | >= 0 < 3.12.0-4 | 3.12.0-4 |
| puma | puma | >= 0 < 4.3.8-1 | 4.3.8-1 |
| puma | puma | >= 0 < 3.12.0-4 | 3.12.0-4 |
| puma | puma | >= 0 < 4.3.8-1 | 4.3.8-1 |
| puma | puma | >= 0 < 3.12.0-4 | 3.12.0-4 |
| puma | puma | >= 0 < 4.3.8-1 | 4.3.8-1 |
| puma | puma | >= 0 < 3.12.0-4 | 3.12.0-4 |
| puma | puma | >= 0 < 4.3.8-1 | 4.3.8-1 |
| puma | puma | >= 0 < 4.3.8 | 4.3.8 |
| puma | puma | >= 0 < 3.12.2 | 3.12.2 |
| puma | puma | >= 3.0.0 < 3.12.2 | 3.12.2 |
| puma | puma | >= 4.0.0 < 4.3.1 | 4.3.1 |
| puma | puma | >= 4.0.0 < 4.3.1 | 4.3.1 |
| puma | puma | >= 5.0.0 < 5.3.1 | 5.3.1 |
| puma | puma | >= 5.0.0 < 5.3.1 | 5.3.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Puma's Keepalive Connections Causing Denial Of Service
osv·2021-05-18·CVSS 7.5
CVE-2021-29509 [HIGH] Puma's Keepalive Connections Causing Denial Of Service
Puma's Keepalive Connections Causing Denial Of Service
This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).
### Impact
The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.
A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.
### Patches
This problem h
GHSA
Puma's Keepalive Connections Causing Denial Of Service
ghsa·2021-05-18·CVSS 7.5
CVE-2021-29509 [HIGH] CWE-400 Puma's Keepalive Connections Causing Denial Of Service
Puma's Keepalive Connections Causing Denial Of Service
This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).
### Impact
The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.
A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.
### Patches
This problem h
OSV
CVE-2021-29509: Puma is a concurrent HTTP 1
osv·2021-05-11·CVSS 7.5
CVE-2021-29509 [HIGH] CVE-2021-29509: Puma is a concurrent HTTP 1
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without
OSV
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
osv·2019-12-05
CVE-2019-16770 [MEDIUM] A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
## Keepalive thread overload/DoS
### Impact
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.
If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
### Patches
This vulnerability is patched in Puma 4.3.1 and 3.12.2.
### Workarounds
Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.
### For more information
If you have any qu
GHSA
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
ghsa·2019-12-05
CVE-2019-16770 [MEDIUM] CWE-770 A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
## Keepalive thread overload/DoS
### Impact
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.
If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
### Patches
This vulnerability is patched in Puma 4.3.1 and 3.12.2.
### Workarounds
Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.
### For more information
If you have any qu
OSV
CVE-2019-16770: In Puma before versions 3
osv·2019-12-05·CVSS 7.5
CVE-2019-16770 [HIGH] CVE-2019-16770: In Puma before versions 3
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
Red Hat
rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS)
vendor_redhat·2021-05-11·CVSS 5.3
CVE-2021-29509 [MEDIUM] CWE-400 rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS)
rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS)
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requ
Debian
CVE-2021-29509: puma - Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE...
vendor_debian·2021·CVSS 5.3
CVE-2021-29509 [MEDIUM] CVE-2021-29509: puma - Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE...
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without
Red Hat
rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
vendor_redhat·2019-12-05·CVSS 5.3
CVE-2019-16770 [MEDIUM] CWE-770 rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
A flaw was found in rubygem-puma. A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests
Debian
CVE-2019-16770: puma - In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keep...
vendor_debian·2019·CVSS 5.3
CVE-2019-16770 [MEDIUM] CVE-2019-16770: puma - In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keep...
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
Scope: local
bookworm: resolved (fixed in 3.12.0-4)
bullseye: resolved (fixed in 3.12.0-4)
forky: resolved (fixed in 3.12.0-4)
sid: resolved (fixed in 3.12.0-4)
trixie: resolved (fixed in 3.12.0-4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-16770 rubygem-puma: puma: keepalive requests from poorly-behaved client leads to denial of service [fedora-all]
bugzilla·2020-05-04·CVSS 5.3
CVE-2019-16770 [MEDIUM] CVE-2019-16770 rubygem-puma: puma: keepalive requests from poorly-behaved client leads to denial of service [fedora-all]
CVE-2019-16770 rubygem-puma: puma: keepalive requests from poorly-behaved client leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: thi
Bugzilla
CVE-2019-16770 rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
bugzilla·2020-05-04·CVSS 5.3
CVE-2019-16770 [MEDIUM] CVE-2019-16770 rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
CVE-2019-16770 rubygem-puma: keepalive requests from poorly-behaved client leads to denial of service
In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
References:
https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
Discussion:
Upstream Patch:
https://github.com/puma/puma/commit/06053e60908074bb38293d4449ea261cb009b53e
---
Created rubygem-puma tracking bugs for this issue:
Affects: fedora-all [bug 1831306]
---
Statement:
https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5https://github.com/puma/puma/security/policyhttps://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlhttps://rubygems.org/gems/pumahttps://security.gentoo.org/glsa/202208-28https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5https://github.com/puma/puma/security/policyhttps://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlhttps://rubygems.org/gems/pumahttps://security.gentoo.org/glsa/202208-28
2021-05-11
Published