Security update for rubygem-puma SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2761-1 Final 1 1 2021-08-17T15:12:24Z current 2021-08-17T15:12:24Z 2021-08-17T15:12:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-puma This update for rubygem-puma fixes the following issues: - CVE-2021-29509: Incomplete fix for CVE-2019-16770 allows Denial of Service (bsc#1188527) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2761,SUSE-OpenStack-Cloud-Crowbar-8-2021-2761 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212761-1/ Link for SUSE-SU-2021:2761-1 https://lists.suse.com/pipermail/sle-security-updates/2021-August/009303.html E-Mail link for SUSE-SU-2021:2761-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188527 SUSE Bug 1188527 https://www.suse.com/security/cve/CVE-2021-29509/ SUSE CVE CVE-2021-29509 page SUSE OpenStack Cloud Crowbar 8 ruby2.1-rubygem-puma-2.16.0-3.12.1 ruby2.1-rubygem-puma-doc-2.16.0-3.12.1 ruby2.1-rubygem-puma-2.16.0-3.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma. CVE-2021-29509 SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-puma-2.16.0-3.12.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212761-1/ https://www.suse.com/security/cve/CVE-2021-29509.html CVE-2021-29509 https://bugzilla.suse.com/1188527 SUSE Bug 1188527