CVE-2022-23634

Impact

Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly.

From Rails:

Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

Patches

This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: https://github.com/advisories/GHSA-wh98-p28r-vrc9 for details about the rails vulnerability

Upgrading to a patched Rails or Puma version fixes the vulnerability.

Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The Rails CVE includes a middleware that can be used instead.

References

• Rails CVE: CVE-2022-23633

For more information

If you have any questions or comments about this advisory:

• Open an issue in puma
• See our security policy

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.(CVE-2021-41136)

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

These are all security issues fixed in the ruby3.1-rubygem-puma-5.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-puma-6.0.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-puma-6.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-puma-6.4.3-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-puma-6.4.3-1.5 package on the GA media of openSUSE Tumbleweed.

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• libsolv: Heap-based buffer overflow in testcase_read() in src/testcase.c (CVE-2021-3200)
• satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)
• candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)
• candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)
• candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)
• candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)
• tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)
• python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)
• libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)
• tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)
• logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)
• candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)
• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)
• python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420)
• libsolv: Heap overflow (CVE-2021-44568)
• python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)
• tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)
• tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)
• python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)
• tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)
• python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

• New repo layout for Satellite, Utils, Maintenance, and Client repos.
• Support for Rocky Linux 9 clients
• Module-based installation on Rocky Linux 8
• Upgrading Satellite Server and Capsule Server installations from Rocky Linux 7 to Rocky Linux 8
• Connected and Disconnected servers supported on Rocky Linux 7 and Rocky Linux 8
• Inter-Server Synchronization improvements
• Puppet integration optional and disabled by default
• Pulp 3 updated to Python 3.8
• Change to Capsule certificate archive
• New default port for communication with Rocky Enterprise Software Foundation Subscription Management * (RHSM) API on Capsule servers
• New Content Views Page (Content Publication workflow simplification)
• New Hosts Page (Technology Preview)
• Registration and preview templates
• Simplified host content source changing
• Improved behavior for configuring and running remote jobs
• Provisioning improvements
• New error signaling unsupported options in TASK-Filter
• Virt-who configuration enhanced to support Nutanix AHV
• Cloud Connector configuration updated
• Improved Insights adoption

The items above are not a complete list of changes. This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

This update for rubygem-puma fixes the following issues:

rubygem-puma was updated to version 4.3.11:

• CVE-2021-29509: Adjusted an incomplete fix for allows Denial of Service (DoS) (bsc#1188527)
• CVE-2021-41136: Fixed request smuggling if HTTP header value contains the LF character (bsc#1191681)
• CVE-2022-23634: Fixed information leak between requests (bsc#1196222)

ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11076)

It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11077)

Jean Boussier discovered that Puma might not always release resources properly after handling HTTP requests. A remote attacker could possibly use this issue to read sensitive information. (CVE-2022-23634)

It was discovered that Puma incorrectly handled certain malformed headers. A remote attacker could use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-24790)

Ben Kallus discovered that Puma incorrectly handled parsing certain headers. A remote attacker could use this issue to perform an HTTP Request Smuggling attack. (CVE-2023-40175)

Bartek Nowotarski discovered that Puma incorrectly handled parsing certain encoded content. A remote attacker could possibly use this to cause a denial of service. (CVE-2024-21647)