CVE-2021-29509: Keepalive Connections Causing Denial Of Service in puma
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queuerequests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.
Other sources
The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.
External Reference:
https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pumato a version that resolves this vulnerability.Fixed in 4.3.8 - Upgrade
Upgrade
redhat/pumato a version that resolves this vulnerability.Fixed in 5.3.1 - Upgrade
Upgrade
pumato a version that resolves this vulnerability.Fixed in 4.3.8 - Upgrade
Upgrade
pumato a version that resolves this vulnerability.Fixed in 5.3.1 - Configuration
Set `queue_requests` to `false` to also fix the keep-alive connection denial-of-service issue.
puma queue_requests = false - Compensating control
When using puma without a reverse proxy (e.g., nginx or apache), the issue is not advised because it can expose you to slow client attacks such as slowloris; use a reverse proxy if applicable to mitigate greedy persistent-connection starvation behavior.
Event History
Frequently Asked Questions
What is CVE-2021-29509?
CVE-2021-29509 is a vulnerability in the Puma HTTP server that allows greedy persistent connections to saturate all threads in the same process, resulting in denial-of-service (DoS) conditions.
What is the severity of CVE-2021-29509?
The severity of CVE-2021-29509 is high, with a CVSS score of 7.5.
How does CVE-2021-29509 affect Puma?
CVE-2021-29509 affects Puma versions up to and excluding 4.3.8 and versions up to and excluding 5.3.1.
How can I fix CVE-2021-29509?
To fix CVE-2021-29509, update your Puma installation to version 4.3.8 or higher for versions below 5.0.0, or version 5.3.1 or higher for versions between 5.0.0 and 5.3.1.
Where can I find more information about CVE-2021-29509?
You can find more information about CVE-2021-29509 on the Red Hat Security Advisory page: https://access.redhat.com/security/cve/CVE-2019-16770