UBUNTU-CVE-2019-16770

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-16770
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-16770.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-16770
Upstream
Withdrawn
2025-07-18T16:45:21Z
Published
2019-12-05T20:15:00Z
Modified
2025-07-16T07:39:45.109493Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.

References

Affected packages

Ubuntu:20.04:LTS / puma

Package

Name
puma
Purl
pkg:deb/ubuntu/puma@3.12.0-4ubuntu1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.0-4ubuntu1

Affected versions

3.*

3.12.0-2ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "puma",
            "binary_version": "3.12.0-4ubuntu1"
        },
        {
            "binary_name": "puma-dbgsym",
            "binary_version": "3.12.0-4ubuntu1"
        }
    ]
}