Information disclosure in Puma
CVE-2022-23634
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.021 (81.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Puma — versions >= 5.0.0, < 5.6.2, < 4.3.11
- Rubyonrails Rails
- Debian Linux — versions 9.0, 10.0, 11.0
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
References
- github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h (Patch, Third Party Advisory)
- github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb (Patch, Third Party Advisory)
- github.com/advisories/GHSA-rmj8-8hhh-gv5h (Third Party Advisory)
- github.com/advisories/GHSA-wh98-p28r-vrc9 (Third Party Advisory, Mitigation, Not Applicable)
- groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ (Patch, Mailing List, Third Party Advisory, Mitigation)
- www.debian.org/security/2022/dsa-5146 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/05/msg00034.html (mailing-list, Mailing List, Third Party Advisory)
- security.gentoo.org/glsa/202208-28 (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2022/08/msg00015.html (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2022-23634?
- CVE-2022-23634 is a high-severity vulnerability in Puma, classified under Information Disclosure. CVSS score: 8.0/10. Published 2022-02-11.
- How severe is CVE-2022-23634?
- High severity. CVSS v3 base score is 8.0 out of 10.