CVE-2021-29509
Summary
| CVE | CVE-2021-29509 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-11 17:15:00 UTC |
|---|
| Updated | 2022-10-27 12:39:00 UTC |
|---|
| Description | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Operating System |
Debian |
Debian Linux |
10.0 |
All |
All |
All |
| Application |
Puma |
Puma |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Security Policy · puma/puma · GitHub |
MISC |
github.com |
|
| Puma: Multiple Vulnerabilities (GLSA 202208-28) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] [DLA 3083-1] puma security update |
MLIST |
lists.debian.org |
|
| puma | RubyGems.org | your community gem host |
MISC |
rubygems.org |
|
| Puma keepalive patch · GitHub |
MISC |
gist.github.com |
|
| Keepalive Connections Causing Denial Of Service in puma · Advisory · puma/puma · GitHub |
CONFIRM |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 180214 Debian Security Update for puma (CVE-2021-29509)
- 180972 Debian Security Update for puma (DLA 3083-1)
- 239895 Red Hat Update for Satellite 6.10 (RHSA-2021:4702)
- 354428 Amazon Linux Security Advisory for rubygem-puma : ALAS2022-2022-051
- 710598 Gentoo Linux Puma Multiple Vulnerabilities (GLSA 202208-28)
- 753159 SUSE Enterprise Linux Security Update for rubygem-puma (SUSE-SU-2022:1515-1)
