CVE-2021-29509 Keepalive Connections Causing Denial Of Service in puma

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...

CVE-2021-29509

CVE-2021-29509 affects the Puma HTTP/1.1 server for Ruby/Rack apps. The issue is that, even after the CVE-2019-16770 fix, new keep-alive connections can still cause denial of service by saturating threadpools across a cluster, starving additional connections. The problem is triggered when more co...

CVE-2021-29509

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...

Friday Squid Blogging: Squid-Shaped Bike Rack

Theres a new squid-shaped bike rack in Ballard, WA. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

rubygem-rack: hijack sessions by using timing attacks targeting the session id

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality...

Ubuntu: Security Advisory (USN-4561-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4561-2: Rack vulnerabilities

USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. Original advisory details: It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive...

USN-4561-2 ruby-rack vulnerabilities

USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. Original advisory details: It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive...

Ubuntu 16.04 LTS / 20.04 LTS : Rack vulnerabilities (USN-4561-2)

The remote Ubuntu 16.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4561-2 advisory. USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu...

The vulnerability of the `check_forbidden` function in the rack/directory.rb module interface between web servers and Rack web applications allows a violator to access confidential data.

The vulnerability of the checkforbidden function in the rack/directory.rb module of the Rack framework, which is used between web servers and web applications, relates to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain...

The vulnerability in the `parse_cookies_header` function of the `utils.rb` module in the Rack web server and web application interface allows a attacker to compromise data integrity.

The vulnerability of the parsecookiesheader function in the utils.rb module of the Rack web server and web application interface is related to the lack of a mechanism for checking input data. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...

The vulnerability of the Rack module in the Ruby programming language, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Ruby interpreter’s Rack module is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures due to specially crafted requests...

Amazon Linux AMI : php72, php73 (ALAS-2020-1440)

The version of php72 installed on the remote host is prior to 7.2.34-1.26. The version of php73 installed on the remote host is prior to 7.3.23-1.29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1440 advisory. In PHP versions 7.2.x below 7.2.34, 7.3.x belo...

rubygem-rack: directory traversal in Rack::Directory

A directory traversal vulnerability was found in the Rack::Directory app that is bundled with Rack. If certain directories exist in a director managed by the Rack::Directory, this flaw allows an attacker to read the contents of files on the server outside of the root specified in the...

rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names

A flaw was found in rubygem-rack. An attacker may be able to trick a vulnerable application into processing an insecure non-SSL or cross-origin request if they can gain the ability to write arbitrary cookies that are sent to the application. The highest threat from this vulnerability is to data...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

rubygem-rack: hijack sessions by using timing attacks targeting the session id

A flaw was found in rubygem-rack in versions prior to 1.6.12 and 2.0.8. An information leak may allow an attacker to find and hijack sessions using timing attacks targeting the session ID. The highest threat from the vulnerability is to data confidentiality...

Web Cache Poisoning

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...