PT-2019-14826 · Ruby+1 · Puma+1
Nateberkopec
·
Publicado
2019-12-05
·
Atualizado
2026-03-13
·
CVE-2019-16770
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Puma versions prior to 3.12.2
Puma versions prior to 4.3.1
Description
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
Recommendations
For versions prior to 3.12.2, update to version 3.12.2 or later to resolve the issue.
For versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue.
As a temporary workaround, consider configuring reverse proxies in front of Puma to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.
Exploit
Correção
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Puma
Suse