Описание
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
A flaw was found in Puma, a Ruby/Rack web server. When PROXY protocol v1 support is enabled, a remote attacker can continuously send data without proper termination. This causes the server to consume an increasing amount of memory and CPU resources, leading to a Denial of Service (DoS) where the server becomes unresponsive or crashes.
Отчет
This issue only affects Puma deployments that explicitly enable the non-default proxy_protocol: :v1 remote-address configuration (set_remote_address proxy_protocol: :v1). An unauthenticated network attacker able to open a TCP connection to such a listener can send bytes without a terminating CRLF, causing unbounded growth of an internal pre-parse buffer and a potential denial of service. Deployments that do not enable this configuration are not affected by this specific issue.
Меры по смягчению последствий
Upgrade to Puma 7.2.1 (7.x branch) or 8.0.2 (8.x branch), whichever applies to the deployed release line. If an immediate upgrade is not possible, remove or comment out the set_remote_address proxy_protocol: :v1 configuration directive if it is not required, or restrict direct network access to the affected Puma listener to trusted load balancers or reverse proxies only.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | pcs | Not affected | ||
| Red Hat Enterprise Linux 8 | pcs | Not affected | ||
| Red Hat Enterprise Linux 9 | pcs | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer. This issue is fixed in versions 7.2.1 and 8.0.2.
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until ...
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
7.5 High
CVSS3