UBUNTU-CVE-2019-16770

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-16770
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-16770.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-16770
Related
Published
2019-12-05T20:15:00Z
Modified
2019-12-05T20:15:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

References

Affected packages

Ubuntu:20.04:LTS / puma

Package

Name
puma
Purl
pkg:deb/ubuntu/puma?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4ubuntu1

Affected versions

3.*

3.12.0-2ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.12.0-4ubuntu1",
            "binary_name": "puma"
        },
        {
            "binary_version": "3.12.0-4ubuntu1",
            "binary_name": "puma-dbgsym"
        }
    ]
}