Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `22.214.171.124`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 126.96.36.199, 188.8.131.52, and 184.108.40.206. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
Please bump to 5.6.2.
Puma 5.6.2 has now been added.
Thanks, please cleanup!
(In reply to John Helmert III from comment #2)
> Thanks, please cleanup!
Sorry, this one needs stabilization.
GLSA request filed
The bug has been referenced in the following commit(s):
Author: GLSAMaker <firstname.lastname@example.org>
AuthorDate: 2022-08-14 21:41:58 +0000
Commit: Sam James <email@example.com>
CommitDate: 2022-08-14 21:43:20 +0000
[ GLSA 202208-28 ] Puma: Multiple Vulnerabilities
Signed-off-by: GLSAMaker <firstname.lastname@example.org>
Signed-off-by: Sam James <email@example.com>
glsa-202208-28.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
GLSA done, all done.