CVE-2019-16770 Potential DOS attack in Puma

2019-12-0519:35:14

CWE-770

GitHub_M

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.5%

JSON

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma’s reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

CNA Affected

[
  {
    "product": "puma",
    "vendor": "puma",
    "versions": [
      {
        "lessThan": "4.3.1",
        "status": "affected",
        "version": "< 4.3.1",
        "versionType": "custom"
      }
    ]
  }
]