🚨 [security] Update puma: 4.3.5 → 4.3.8 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ puma (4.3.5 → 4.3.8) · Repo · Changelog

Security Advisories 🚨

🚨 Keepalive Connections Causing Denial Of Service in puma

Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected
existing connections that had already been accepted from having their
requests starved by greedy persistent-connections saturating all threads in
the same process. However, new connections may still be starved by greedy
persistent-connections saturating all threads in all processes in the
cluster.

A puma server which received more concurrent keep-alive connections than the
server had threads in its threadpool would service only a subset of
connections, denying service to the unserved connections.

Patches

This problem has been fixed in puma 4.3.8 and 5.3.1.

Workarounds

Setting queue_requests false also fixes the issue. This is not advised when
using puma without a reverse proxy, such as nginx or apache, because you will
open yourself to slow client attacks (e.g. slowloris).

The fix is very small. A git patch is available here for those using
unsupported versions of Puma.

Release Notes

4.3.8

• Security
  • Close keepalive connections after the maximum number of fast inlined requests (#2625)

4.3.7 (from changelog)

• Bugfixes
  • Backport set CONTENT_LENGTH for chunked requests (Originally: #2287, backport: #2496)

4.3.6

v4.3.5...4.3.6

A quick fix for a build error on Mac OS and a JSON require fix for those using phased restart.

• Explicitly include ctype.h to fix compilation warning and build error on macOS with Xcode 12 (#2304)
• Don't require json at boot (#2269)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

• 4.3.8 release note
• Bump version constant
• Close keepalive connections after MAX_FAST_INLINE requests
• 4.3.7
• Backport set CONTENT_LENGTH for chunked requests (#2496)
• Updates to 4.3.6 to pass CI, adds Ubuntu 20.04 [changelog skip] (#2380)
• v4.3.6
• Merge pull request #2314 from venables/fix-include
• Merge pull request #2269 from MSP-Greg/json-require

↗️ nio4r (indirect, 2.5.2 → 2.5.7) · Repo · Changelog

Release Notes

2.5.4 (from changelog)

• #251 Intermittent SEGV during GC. (@boazsegev)

2.5.3 (from changelog)

• #241 Possible bug with Ruby >= 2.7.0 and GC.compact. (@boazsegev)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 72 commits:

• Patch version bump.
• Allow usage of native extension by default.
• Don't try to link universal extension.
• Patch version bump.
• Suggest kqueue on OSX if >= 10.12.2
• Avoid requiring linux kernel headers to be present
• CI: Remove the macos-11.0 target, for now
• CHANGES.md: add v2.5.5
• Patch version bump.
• Be more explicit with why `pure?` is being used.
• Workaround for ARM-based macOS bundled Ruby
• Allow pure Ruby and Java NIO::Selector to be initialized with nil
• Declare linuxaio and io_uring experimental
• linuxaio is actually only supported on linux kernel 4.19+
• Define EV_USE_IOURING if header is present
• Patch libev and add support for linuxaio and io_uring
• Upgrade libev to verion 4.33
• Add ruby 3.0 to the README
• Add ruby 3.0 to the CI pipeline
• Actions - add MRI head/master for Ubuntu & macOS
• Update Actions workflow - OS changes & additions
• Fix javac -Xlint warnings
• Prepare for v2.5.4 release.
• Remove unneeded assertions.
• Update ext/nio4r/monitor.c
• replace `if` with assert, keep memory init.
• actually, initialize the whole memory block to zero
• test allocation for failure and initialize memory
• Add `if` statement, even if redundant
• README.md: update build status badge
• Move `EV_STANDALONE` definition to `extconf.rb` (#250)
• Add space between control statements and brackets.
• Use clang-format to improve code consistency.
• Remove cruft from README.
• Remove ancient Guardfile.
• Bump version.
• Remove ancient appveyor config.
• Prepare CHANGES.md for next release.
• fix for #241
• Fix Actions CI for macOS
• ssl_socket_spec.rb - move require inside block
• Fixes for use when OpenSSL is not loaded
• Fix warning: Use `result.unpack1("i")` instead of `result.unpack("i").first`. (convention:Style/UnpackFirst)
• Setting 'Enabled: false' for the new cops of Rubocop
• Fix warning: Metrics/LineLength has the wrong namespace - should be Layout
• Update rubocop version to 2.4
• Fix warning: The `Lint/HandleExceptions` cop has been renamed to `Lint/SuppressedException`.
• Fix warning: The `Layout/AlignHash` cop has been renamed to `Layout/HashAlignment`
• Bumb Rubocop to 0.82.0
• Use truffleruby-head in CI
• CI: Exclude TruffleRuby on Windows
• Remove travis config and update github actions.
• Update travis configuration.
• Add ruby 2.7
• Merge pull request #234 from MSP-Greg/add-actions
• Remove redundant jobs from AppVeyor
• Remove redundant jobs from Travis
• Add Actions CI - workflow.yml
• extconf.rb - add devkit for mingw
• Fix Warning: unrecognized cop Performance/RegexpMatch found in .rubocop.yml
• Fix Lint/UnneededCopEnableDirective
• Fix Naming/RescuedExceptionsVariableName
• Fix Lint/UnneededCopEnableDirective
• disable Layout/AlignHash
• Fix Style/ExpandPathArguments
• Fix Layout/EmptyLineAfterGuardClause
• Fix Style/ExpandPathArguments
• bump rubocop to 0.74.0
• CI: Add 2.7 to the matrix
• Polish examples/echo_server.rb
• Update CHANGES.md
• Update CHANGES.md

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #362.