Bug 1842534 (CVE-2020-11077)

Summary: CVE-2020-11077 rubygem-puma: HTTP Smuggling through a proxy via Transfer-Encoding Header
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akarol, dmetzger, gmccullo, gtanzill, hvyas, jaruga, jhardy, proguski, roliveri, ruby-packagers-sig, simaishi, smallamp, vondruch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: rubygem-puma 4.3.5, rubygem-puma 3.12.6 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in rubygem-puma. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-28 08:15:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1842535, 1842953, 1843847    
Bug Blocks: 1842541    

Description Guilherme de Almeida Suckevicz 2020-06-01 13:38:58 UTC 
In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

References:
https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxm
https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
Comment 1 Guilherme de Almeida Suckevicz 2020-06-01 13:39:20 UTC 
Created rubygem-puma tracking bugs for this issue:

Affects: fedora-all [bug 1842535]
Comment 3 Przemyslaw Roguski 2020-06-02 12:49:54 UTC 
External References:

https://github.com/puma/puma/security/advisories/GHSA-w64w-qqph-5gxm
Comment 4 Przemyslaw Roguski 2020-06-02 12:49:56 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 6 Przemyslaw Roguski 2020-06-03 08:05:37 UTC 
Statement:

Red Hat Gluster Storage 3 Web Administration component uses affected RubyGem Puma, which does not have the http body chunk verification.