CVE-2021-41136

Impact

Prior to puma version 5.5.0, using puma with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

Patches

This vulnerability was patched in Puma 5.5.1 and 4.3.9.

Workarounds

This vulnerability only affects Puma installations without any proxy in front.

Use a proxy which does not forward LF characters as line endings.

Proxies which do not forward LF characters as line endings:

• Nginx
• Apache (>2.4.25)
• Haproxy
• Caddy
• Traefik

Possible Breakage

If you are dealing with legacy clients that want to send LF as a line ending in an HTTP header, this will cause those clients to receive a 400 error.

References

• HTTP Request Smuggling

For more information

If you have any questions or comments about this advisory:

• Open an issue in Puma
• See our security policy

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.(CVE-2021-41136)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.(CVE-2021-41136)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.(CVE-2021-41136)

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications.

Security Fix(es):

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.(CVE-2021-41136)

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.(CVE-2022-23634)

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.

These are all security issues fixed in the ruby3.1-rubygem-puma-4-4.3.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-puma-5-5.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-puma-5-5.6.5-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-puma-5-5.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• libsolv: Heap-based buffer overflow in testcase_read() in src/testcase.c (CVE-2021-3200)
• satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)
• candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)
• candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)
• candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)
• candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)
• tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)
• python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)
• libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)
• tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)
• logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)
• candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)
• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)
• python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420)
• libsolv: Heap overflow (CVE-2021-44568)
• python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)
• tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)
• tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)
• python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)
• tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)
• python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

• New repo layout for Satellite, Utils, Maintenance, and Client repos.
• Support for Rocky Linux 9 clients
• Module-based installation on Rocky Linux 8
• Upgrading Satellite Server and Capsule Server installations from Rocky Linux 7 to Rocky Linux 8
• Connected and Disconnected servers supported on Rocky Linux 7 and Rocky Linux 8
• Inter-Server Synchronization improvements
• Puppet integration optional and disabled by default
• Pulp 3 updated to Python 3.8
• Change to Capsule certificate archive
• New default port for communication with Rocky Enterprise Software Foundation Subscription Management * (RHSM) API on Capsule servers
• New Content Views Page (Content Publication workflow simplification)
• New Hosts Page (Technology Preview)
• Registration and preview templates
• Simplified host content source changing
• Improved behavior for configuring and running remote jobs
• Provisioning improvements
• New error signaling unsupported options in TASK-Filter
• Virt-who configuration enhanced to support Nutanix AHV
• Cloud Connector configuration updated
• Improved Insights adoption

The items above are not a complete list of changes. This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

This update for ardana-ansible, ardana-monasca, documentation-suse-openstack-cloud, openstack-ec2-api, openstack-heat-templates, python-Django, python-monasca-common, rubygem-redcarpet, rubygem-puma contains the following fixes:

Security fixes included in this update:

rubygem-redcarpet: CVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)

rubygem-puma: CVE-2021-41136: Fixed build of the Java state machine for parsing HTTP. (bsc#1191681)

Non-security fixes included in this update:

Changes in ardana-ansible:

• Patch service.py to skip blank lines.

Changes in ardana-monasca:

• Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)

Changes in documentation-suse-openstack-cloud:

• CI: only run on DocBook/AsciiDoc paths, make upload fails nonfatal
• DC files: Update to 2021 stylesheets (#1327)
• CI: Use GitHub Actions

Changes in openstack-ec2-api:

• Remove jobs corresponds to obselete featuresets
• OpenDev Migration Patch

Changes in openstack-heat-templates:

• [ussuri][goal] Update contributor documentation

Changes in python-Django:

• Add missing dependency for CVE-2021-31542

Changes in python-monasca-common:

• Remove renderspec source service.
• Retry publish once on failures. (SOC-11543)

This update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma contains the following fixes:

Security fixes included in this update:

kibana: CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).

python-eventlet: CVE-2021-21419: Fixed improper handling of highly compressed data and memory allocation with excessive size value. (bsc#1185836)

rubygem-redcarpet: CVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)

rubygem-puma: CVE-2021-41136: Fixes build of the Java state machine for parsing HTTP. (bsc#1191681)

Non-security fixes included in this update:

Changes in ardana-ansible:

• Patch service.py to skip blank lines.

Changes in ardana-monasca:

• Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)

Changes in crowbar-openstack:

• keystone wakeup: get new session on any error. (bsc#1189052)

Changes in influxdb:

• Set GO111MODULE=auto to fix build with go1.16 and later where default is GO111MODULE=on

Canges in kibana:

• Fix an open redirect flaw. (CVE-2021-22141, bsc#1186868)

Changes in openstack-cinder:

• Fix typo in Dell EMC Unity driver documentation.
• Drop lower-constraints job.
• [stable-only] Cap bandit to v1.6.2 and fix constraints.

Changes in openstack-ec2-api:

• Remove jobs corresponds to obselete featuresets.
• OpenDev Migration Patch.

Changes in openstack-heat-gbp:

• Add support for Wallaby.
• Fix upstream gate.

Changes in openstack-heat-templates:

• [ussuri][goal] Update contributor documentation.
• Fix zuul config for heat-templates-check.
• Remove testr.

Changes in openstack-horizon-plugin-gbp-ui:

• Add support for Wallaby.
• Fix upstream gate.

Changes in openstack-keystone:

• Retry update_user when sqlalchemy raises StaleDataErrors.
• Pin keystone-tempest-plugin for py27 compatibility.

Changes in openstack-neutron-gbp:

• Fix update router API.
• Fix HA IP DB migration.
• Revert 'Fix HA IP DB migration'.
• Fix HA IP DB migration.
• Add network_id column to apic_ml2_ha_ipaddress_to_port_owner table.
• Use custom converter for extra attributes.
• Validate network before creating or updating router.
• Fix Data Migration query for HA IP table.
• System security grp:Add system sg in port sg list.
• Add vrf column to apic_ml2_ha_ipaddress_to_port_owner table.
• [apic_aim]: Fix HA IP UTs.
• Fixing the exception msg for IPAddressGenerationFailure.
• Enhancement regarding router/instance attachment to an external network floating ip and snat subnets.
• Setting legacy-group-based-policy-dsvm-aim to non-voting gate.
• Add support for Wallaby.
• Bug fixes for gbp-validate.
• [apic_aim]: Filter endpoint details.
• Bugfix: Policy Enforcement Pref.
• Fix unit-tests for tenant-scope validation.
• [AIM] Add Policy Enforcement Pref to network extension.

Changes in openstack-nova:

• [neutron] Get only ID and name of the SGs from Neutron.
• Remove allocations before setting vm_status to SHELVED_OFFLOADED.
• libvirt:driver:Disallow AIO=native when 'O_DIRECT' is not available.
• Update pci stat pools based on PCI device changes.
• Use subqueryload() instead of joinedload() for (system_)metadata.

Changes in python-eventlet: Websocket: Limit maximum uncompressed frame length to 8MiB. (bsc#1185836 CVE-2021-21419)

This update for rubygem-puma fixes the following issues:

rubygem-puma was updated to version 4.3.11:

• CVE-2021-29509: Adjusted an incomplete fix for allows Denial of Service (DoS) (bsc#1188527)
• CVE-2021-41136: Fixed request smuggling if HTTP header value contains the LF character (bsc#1191681)
• CVE-2022-23634: Fixed information leak between requests (bsc#1196222)