Description
Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR. This issue is fixed in versions 7.2.1 and 8.0.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
puma puma
>= 5.5.0, < 7.2.1affected>= 8.0.0, < 8.0.2affected
References
- https://github.com/puma/puma/security/advisories/GHSA-2vqw-3mp8-cgmx ↗
- https://github.com/puma/puma/pull/3944 ↗
- https://github.com/puma/puma/pull/3947 ↗
- https://github.com/puma/puma/commit/439c6136d9c2275721b7864db3ee78af7c80889f ↗
- https://github.com/puma/puma/commit/ebe9db3929ab8299d19c8f5b41e8ef4f4b22fa58 ↗
- https://github.com/puma/puma/releases/tag/v7.2.1 ↗
- https://github.com/puma/puma/releases/tag/v8.0.2 ↗