Описание
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
A flaw was found in Puma, a Ruby/Rack web server. When set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection. This allows a remote attacker to inject a second PROXY header, leading to source IP (Internet Protocol) spoofing and potentially impacting security logging or access control decisions.
Отчет
This flaw only affects Puma deployments that explicitly enable set_remote_address proxy_protocol: :v1 together with persistent (keep-alive) connections to the proxy. This is not Puma default configuration.
Меры по смягчению последствий
Upgrade puma to 7.2.1 or 8.0.2 (or later). If an immediate upgrade is not possible, remove the set_remote_address proxy_protocol: :v1 configuration, or disable persistent connections (enable_keep_alives false), to prevent PROXY protocol v1 header re-parsing on the same connection.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | pcs | Not affected | ||
| Red Hat Enterprise Linux 8 | pcs | Not affected | ||
| Red Hat Enterprise Linux 9 | pcs | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until ...
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
7.5 High
CVSS3