CVE-2019-16770

 

Published at: - 05-12-2019 09:15

Last modified: - 08-10-2022 04:42

Total changes: - 3

Description

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
• [debian-lts-announce] 20220525 [SECURITY] [DLA 3023-1] puma security update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2019-16770

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures