Log in Start free

Vulnerability · Published Feb 11, 2022 · Assigned by GitHub_M

CVE-2022-23634Information Exposure when using Puma with Rails

High 8.0

In plain English

A high-severity information exposure in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)2.1%top 18.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12puma5.6.4-1DEBIAN-CVE-2022-23634
Debian:13puma5.6.4-1DEBIAN-CVE-2022-23634
Debian:14puma5.6.4-1DEBIAN-CVE-2022-23634
Rocky Linux:8libdb0:5.3.28-42.el8_4RLSA-2022:5498
RubyGemspuma5.6.2GHSA-rmj8-8hhh-gv5h
RubyGemspuma4.3.11GHSA-rmj8-8hhh-gv5h

Affected products (as reported)

VendorProductVersions
puma puma >= 5.0.0, < 5.6.2< 4.3.11

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

References