Skip to content
Log inStart free trial

GHSA-rmj8-8hhh-gv5h CVE-2022-23634

Puma used with Rails may lead to Information Exposure

High RubyGems
Severity
8.0 / 10
High · CVSS 3.1
Exploit chance (EPSS)
2.11%
Chance of exploitation in the next 30 days. Higher than 81.76% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-404 Improper Resource Shutdown or Release
Fix
5.6.2
Upgrade puma to this version or later

Description

Impact

Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly.

From Rails:

Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

Patches

This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: https://github.com/advisories/GHSA-wh98-p28r-vrc9 for details about the rails vulnerability

Upgrading to a patched Rails or Puma version fixes the vulnerability.

Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The Rails CVE includes a middleware that can be used instead.

References

For more information

If you have any questions or comments about this advisory:

Affected versions

RubyGems

PackageVulnerableFixed in
puma
>= 5.0.0, < 5.6.2
5.6.2
puma
< 4.3.11
4.3.11

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

puma RubyGems → 5.6.2

bundler
bundle update puma # Gemfile: gem "puma", ">= 5.6.2"

Severity breakdown

CVSS 3.1 8.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-404: Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

How to prevent it
  • Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
  • Implementation: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
  • Implementation: Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
  • Implementation: When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-2vqw-3mp8-cgmx
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
High Also affects puma
GHSA-qpgp-93vx-g8v8
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
High Also affects puma
GHSA-9hf4-67fc-4vf4
Puma's header normalization allows for client to clobber proxy set headers
Medium Also affects puma
GHSA-c2f4-cvqm-65w2
Puma HTTP Request/Response Smuggling vulnerability
High Also affects puma
GHSA-68xg-gqqm-vgj8
Puma HTTP Request/Response Smuggling vulnerability
Critical Also affects puma
GHSA-h99w-9q5r-gjq9
Puma vulnerable to HTTP Request Smuggling
Critical Also affects puma
GHSA-48w2-rm65-62xx
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
Low Also affects puma
GHSA-q28m-8xjw-8vr5
Puma's Keepalive Connections Causing Denial Of Service
High Also affects puma
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor