[Security] Bump puma from 4.2.0 to 5.3.2

[dependabot-preview]

Bumps puma from 4.2.0 to 5.3.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma

Keepalive thread overload/DoS

Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

For more information

If you have any questions or comments about this advisory:

... (truncated)

Affected versions: >= 4.0.0, < 4.3.1

Sourced from The Ruby Advisory Database.

Keepalive thread overload/DoS in puma A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

Patched versions: ~> 3.12.2; >= 4.3.1 Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma In Puma (RubyGem) before 4.3.2 and 3.12.2, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF or/r, /n) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server.

This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.

Affected versions: >= 4.0.0, < 4.3.2

Sourced from The Ruby Advisory Database.

HTTP Response Splitting vulnerability in puma If an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

Patched versions: ~> 3.12.4; >= 4.3.3 Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma

Impact

If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses.

Patches

This has been fixed in 4.3.3 and 3.12.4.

Workarounds

Users can not allow untrusted/user input in the Early Hints response header.

For more information

If you have any questions or comments about this advisory:

• Open an issue in puma
• Email us a project maintainer. Email addresses are listed in our Code of Conduct.

Affected versions: >= 4.0.0, < 4.3.3

Sourced from The GitHub Security Advisory Database.

HTTP Smuggling via Transfer-Encoding Header in Puma

Impact

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

For more information

If you have any questions or comments about this advisory:

• Open an issue in Puma
• See our security policy

Affected versions: >= 4.0.0, < 4.3.5

Sourced from The GitHub Security Advisory Database.

HTTP Smuggling via Transfer-Encoding Header in Puma

Impact

By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.

Originally reported by @​ZeddYu, who has our thanks for the detailed report.

Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

For more information

If you have any questions or comments about this advisory:

• Open an issue in Puma
• See our security policy

Affected versions: >= 4.0.0, < 4.3.4

Sourced from The Ruby Advisory Database.

HTTP Smuggling via Transfer-Encoding Header in Puma

Impact

By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.

Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

Patched versions: ~> 3.12.5; >= 4.3.4 Unaffected versions: none

Sourced from The Ruby Advisory Database.

HTTP Smuggling via Transfer-Encoding Header in Puma

Impact

This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

Patched versions: ~> 3.12.6; >= 4.3.5 Unaffected versions: none

Sourced from The Ruby Advisory Database.

HTTP Response Splitting (Early Hints) in Puma

Impact

If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses.

Patches

This has been fixed in 4.3.3 and 3.12.4.

Workarounds

Users can not allow untrusted/user input in the Early Hints response header.

Patched versions: ~> 3.12.4; >= 4.3.3 Unaffected versions: none

Sourced from The Ruby Advisory Database.

HTTP Response Splitting vulnerability in puma If an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

Patched versions: ~> 3.12.4; >= 4.3.3 Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Keepalive Connections Causing Denial Of Service in puma This vulnerability is related to CVE-2019-16770.

Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

Workarounds

Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris).

The fix is very small. A git patch is available here for those using unsupported versions of Puma.

For more information

... (truncated)

Affected versions: <= 4.3.7

Sourced from The Ruby Advisory Database.

Keepalive Connections Causing Denial Of Service in puma

Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

Workarounds

Setting queue_requests false also fixes the issue. This is not advised when

... (truncated)

Patched versions: ~> 4.3.8; >= 5.3.1 Unaffected versions: none

Release notes

Sourced from puma's releases.

5.3.2

• Bugfixes
  • Gracefully handle Rack not accepting CLI options (#2630, #2626)
  • Fix sigterm misbehavior (#2629)
  • Improvements to keepalive-connection shedding (#2628)

This version was released 2021-05-21.

5.3.1

• Security
  • Close keepalive connections after the maximum number of fast inlined requests (#2625)

5.3.0 - Sweetnighter

5.3.0 / 2021-05-07

Contributor @​MSP-Greg codenamed this release "Sweetnighter".

• Features

  • Add support for Linux's abstract sockets (#2564, #2526)
  • Add debug to worker timeout and startup (#2559, #2528)
  • Print warning when running one-worker cluster (#2565, #2534)
  • Don't close systemd activated socket on pumactl restart (#2563, #2504)

• Bugfixes

  • systemd - fix event firing (#2591, #2572)
  • Immediately unlink temporary files (#2613)
  • Improve parsing of HTTP_HOST header (#2605, #2584)
  • Handle fatal error that has no backtrace (#2607, #2552)
  • Fix timing out requests too early (#2606, #2574)
  • Handle segfault in Ruby 2.6.6 on thread-locals (#2567, #2566)
  • Server#closed_socket? - parameter may be a MiniSSL::Socket (#2596)
  • Define UNPACK_TCP_STATE_FROM_TCP_INFO in the right place (#2588, #2556)
  • request.rb - fix chunked assembly for ascii incompatible encodings, add test (#2585, #2583)

• Performance

  • Reset peerip only if remote_addr_header is set (#2609)
  • Reduce puma_parser struct size (#2590)

• Refactor

  • Refactor drain on shutdown (#2600)
  • Micro optimisations in wait_for_less_busy_worker feature (#2579)
  • Lots of test fixes

5.2.2

• Bugfixes
  • Add #flush and #sync methods to Puma::NullIO (#2553)
  • Restore sync=true on STDOUT and STDERR streams (#2557)

... (truncated)

Changelog

Sourced from puma's changelog.

5.3.2 / 2021-05-21

• Bugfixes
  • Gracefully handle Rack not accepting CLI options (#2630, #2626)
  • Fix sigterm misbehavior (#2629)
  • Improvements to keepalive-connection shedding (#2628)

5.3.1 / 2021-05-11

• Security
  • Close keepalive connections after the maximum number of fast inlined requests (CVE-2021-29509) (#2625)

5.3.0 / 2021-05-07

• Features

  • Add support for Linux's abstract sockets (#2564, #2526)
  • Add debug to worker timeout and startup (#2559, #2528)
  • Print warning when running one-worker cluster (#2565, #2534)
  • Don't close systemd activated socket on pumactl restart (#2563, #2504)

• Bugfixes

  • systemd - fix event firing (#2591, #2572)
  • Immediately unlink temporary files (#2613)
  • Improve parsing of HTTP_HOST header (#2605, #2584)
  • Handle fatal error that has no backtrace (#2607, #2552)
  • Fix timing out requests too early (#2606, #2574)
  • Handle segfault in Ruby 2.6.6 on thread-locals (#2567, #2566)
  • Server#closed_socket? - parameter may be a MiniSSL::Socket (#2596)
  • Define UNPACK_TCP_STATE_FROM_TCP_INFO in the right place (#2588, #2556)
  • request.rb - fix chunked assembly for ascii incompatible encodings, add test (#2585, #2583)

• Performance

  • Reset peerip only if remote_addr_header is set (#2609)
  • Reduce puma_parser struct size (#2590)

• Refactor

  • Refactor drain on shutdown (#2600)
  • Micro optimisations in wait_for_less_busy_worker feature (#2579)
  • Lots of test fixes

5.2.2 / 2021-02-22

• Bugfixes
  • Add #flush and #sync methods to Puma::NullIO (#2553)
  • Restore sync=true on STDOUT and STDERR streams (#2557)

5.2.1 / 2021-02-05

• Bugfixes
  • Fix TCP cork/uncork operations to work with ssl clients (#2550)

... (truncated)

Commits

• f4766ce 5.3.2
• e5f04b4 Actions - bypass RuboCop on MRI Ruby head/master, Psych 4.0 issue
• f9e9102 Gracefully handle Rack not accepting CLI options (#2630)
• 04e4b1a Fix sigterm misbehavior (#2629)
• 8c211dc Update docs for low_latency option and fix parsing issue (#2631)
• ffa5d56 Improvements to keepalive-connection shedding (#2628)
• 1c91a4f 5.3.1
• 6b4a68a 4.3.8 release note
• df72887 Close keepalive connections after MAX_FAST_INLINE requests
• 6dfb8bc 5.3.0 history (#2622)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

• Update frequency
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)