[Security] Bump puma from 3.4.0 to 3.12.6

[dependabot-preview]

Bumps puma from 3.4.0 to 3.12.6. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma

Impact

If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses.

Patches

This has been fixed in 4.3.3 and 3.12.4.

Workarounds

Users can not allow untrusted/user input in the Early Hints response header.

For more information

If you have any questions or comments about this advisory:

• Open an issue in puma
• Email us a project maintainer. Email addresses are listed in our Code of Conduct.

Affected versions: < 3.12.4

Sourced from The Ruby Advisory Database.

HTTP Response Splitting vulnerability in puma If an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

Patched versions: ~> 3.12.4; >= 4.3.3 Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma In Puma (RubyGem) before 4.3.2 and 3.12.2, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF or/r, /n) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server.

This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.

Affected versions: < 3.12.3

Sourced from The Ruby Advisory Database.

Keepalive thread overload/DoS in puma A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

Patched versions: ~> 3.12.2; >= 4.3.1 Unaffected versions: none

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects puma

Keepalive thread overload/DoS

Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

For more information

If you have any questions or comments about this advisory:

... (truncated)

Affected versions: < 3.12.2

Release notes

Sourced from puma's releases.

v3.12.1

v3.11.4

No release notes provided.

3.11.0 - Love Song

• 2 features:

  • HTTP 103 Early Hints (#1403)
  • 421/451 status codes now have correct status messages attached (#1435)

• 9 bugfixes:

  • Environment config files (/config/puma/.rb) load correctly (#1340)
  • Specify windows dependencies correctly (#1434, #1436)
  • puma/events required in test helper (#1418)
  • Correct control CLI's option help text (#1416)
  • Remove a warning for unused variable in mini_ssl (#1409)
  • Correct pumactl docs argument ordering (#1427)
  • Fix an uninitialized variable warning in server.rb (#1430)
  • Fix docs typo/error in Launcher init (#1429)
  • Deal with leading spaces in RUBYOPT (#1455)

• 2 other:

  • Add docs about internals (#1425, #1452)
  • Tons of test fixes from @MSP-Greg (#1439, #1442, #1464)

3.10.0 - Russell's Teapot

• 3 features:

  • The status server has a new /gc and /gc-status command. (#1384)
  • The persistent and first data timeouts are now configurable (#1111)
  • Implemented RFC 2324 (#1392)

• 12 bugfixes:

  • Not really a Puma bug, but @NickolasVashchenko created a gem to workaround a Ruby bug that some users of Puma may be experiencing. See README for more. (#1347)
  • Fix hangups with SSL and persistent connections. (#1334)
  • Fix Rails double-binding to a port (#1383)
  • Fix incorrect thread names (#1368)
  • Fix issues with /etc/hosts and JRuby where localhost addresses were not correct. (#1318)
  • Fix compatibility with RUBYOPT="--enable-frozen-string-literal" (#1376)
  • Fixed some compiler warnings (#1388)
  • We actually run the integration tests in CI now (#1390)
  • No longer shipping unnecessary directories in the gemfile (#1391)
  • If RUBYOPT is nil, we no longer blow up on restart. (#1385)
  • Correct response to SIGINT (#1377)
  • Proper exit code returned when we receive a TERM signal (#1337)

• 3 refactors:

... (truncated)

Changelog

Sourced from puma's changelog.

5.0.0

• Features

  • EXPERIMENTAL: Add fork_worker option and refork command for reduced memory usage by forking from a worker process instead of the master process. (#2099)
  • EXPERIMENTAL: Added wait_for_less_busy_worker config. This may reduce latency on MRI through inserting a small delay before re-listening on the socket if worker is busy (#2079).
  • EXPERIMENTAL: Added nakayoshi_fork option. Reduce memory usage in preloaded cluster-mode apps by GCing before fork and compacting, where available. (#2093, #2256)
  • Added pumactl thread-backtraces command to print thread backtraces (#2054)
  • Added incrementing requests_count to Puma.stats. (#2106)
  • Increased maximum URI path length from 2048 to 8196 bytes (#2167)
  • lowlevel_error_handler is now called during a forced threadpool shutdown, and if a callable with 3 arguments is set, we now also pass the status code (#2203)
  • Faster phased restart and worker timeout (#2220)
  • Added state_permission to config DSL to set state file permissions (#2238)
  • Added Puma.stats_hash, which returns a stats in Hash instead of a JSON string (#2086, #2253)

• Deprecations, Removals and Breaking API Changes

  • --control has been removed. Use --control-url (#1487)
  • worker_directory has been removed. Use directory.
  • min_threads now set by environment variables PUMA_MIN_THREADS and MIN_THREADS. (#2143)
  • max_threads now set by environment variables PUMA_MAX_THREADS and MAX_THREADS. (#2143)
  • max_threads default to 5 in MRI or 16 for all other interpreters. (#2143)
  • preload by default if workers > 1 (#2143)
  • Puma::Plugin.workers_supported? has been removed. Use Puma.forkable? instead. (#2143)
  • tcp_mode has been removed without replacement. (#2169)
  • Daemonization has been removed without replacement. (#2170)
  • Changed #connected_port to #connected_ports (#2076)
  • Configuration: environment is read from RAILS_ENV, if RACK_ENV can't be found (#2022)

• Bugfixes

  • Close client http connections made to an ssl server with TLSv1.3 (#2116)
  • Do not set user_config to quiet by default to allow for file config (#2074)
  • Always close SSL connection in Puma::ControlCLI (#2211)
  • Windows update extconf.rb for use with ssp and varied Ruby/MSYS2 combinations (#2069)
  • Ensure control server Unix socket is closed on shutdown (#2112)
  • Preserve BUNDLE_GEMFILE env var when using prune_bundler (#1893)
  • Send 408 request timeout even when queue requests is disabled (#2119)
  • Rescue IO::WaitReadable instead of EAGAIN for blocking read (#2121)
  • Ensure BUNDLE_GEMFILE is unspecified in workers if unspecified in master when using prune_bundler (#2154)
  • Rescue and log exceptions in hooks defined by users (on_worker_boot, after_worker_fork etc) (#1551)
  • Read directly from the socket in #read_and_drop to avoid raising further SSL errors (#2198)
  • Set Connection: closed header when queue requests is disabled (#2216)
  • Pass queued requests to thread pool on server shutdown (#2122)
  • Fixed a few minor concurrency bugs in ThreadPool that may have affected non-GVL Rubies (#2220)
  • Fix out_of_band hook never executed if the number of worker threads is > 1 (#2177)
  • Fix ThreadPool#shutdown timeout accuracy (#2221)
  • Fix UserFileDefaultOptions#fetch to properly use default (#2233)
  • Improvements to out_of_band hook (#2234)
  • Prefer the rackup file specified by the CLI (#2225)
  • Fix for spawning subprocesses with fork_worker option (#2267)

• Refactor

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)