Ubuntu
puma package

[MIR] Promote puma to main as a pcs dependency

Bug #2006461 reported by Lucas Kanashiro on 2023-02-07

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	puma (Ubuntu)	Fix Released	Undecided	Unassigned

Bug Description

[Availability]
The package puma is already in Ubuntu universe.
The package puma build for the architectures it is designed to work on.
It currently builds and works for architectures: amd64, arm64, armhf, ppc64el, s390x, riscv64
Link to package [[https://launchpad.net/ubuntu/+source/puma|puma]]

[Rationale]
The package puma is required in Ubuntu main for pcs promotion (LP: #1953341).

Ideally, we expect that puma (and pcs) will be promoted in the "L" development cycle. The idea is to promote only the puma binary.

[Security]

Required links:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=puma

12 CVEs are found. Since this package in universe, most of those CVEs are not fixed in Ubuntu:

https://ubuntu.com/security/cves?package=puma

Searching for "site:www.openwall.com/lists/oss-security puma" I got:

https://www.openwall.com/lists/oss-security/2022/02/11/5

which is actually an issue in action pack (rails).

No `suid` or `sgid` binaries.

No executables in `/sbin` and `/usr/sbin`.

Package does not install services, timers or recurring jobs.

Packages does not open privileged ports (ports < 1024).

Packages does not contain extensions to security-sensitive software
(filters, scanners, plugins, UI skins, ...).

[Quality assurance - function/usage]
The package works well right after install.

[Quality assurance - maintenance]
The package is maintained well in Debian/Ubuntu and has not too many
and long term critical bugs open

- Ubuntu https://bugs.launchpad.net/ubuntu/+source/puma/+bug
- Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=puma

The package needs an update in Ubuntu and it will solved really soon.

The package does not deal with exotic hardware we cannot support.

[Quality assurance - testing]
The package runs a test suite on build time, if it fails
it makes the build fail, link to build log:

https://launchpadlibrarian.net/649511810/buildlog_ubuntu-lunar-amd64.puma_5.5.2-2ubuntu4_BUILDING.txt.gz

The package runs an autopkgtest, and is currently passing on
this list of architectures: amd64, arm64, armhf, ppc64el.

Link to test logs:

https://autopkgtest.ubuntu.com/packages/puma

The package does have not failing autopkgtests right now, but s390x where we have some failures due to ruby 3.1 transition, tests run against ruby 3.0 fails.

[Quality assurance - packaging]
debian/watch is present and works.

debian/control defines a correct Maintainer field.

Output of `lintian --pedantic` against the source package present in lunar:

W: puma source: unknown-field Ruby-Versions
P: puma source: maintainer-manual-page [debian/puma.1]
P: puma source: maintainer-manual-page [debian/pumactl.1]
P: puma source: renamed-tag debian-watch-does-not-check-gpg-signature => debian-watch-does-not-check-openpgp-signature [debian/source/lintian-overrides:2]
P: puma source: spelling-error-in-patch-description regresion regression [debian/patches/skip-tests-hanging-on-different-arches.patch]
P: puma source: trailing-whitespace [debian/changelog:141]
P: puma source: update-debian-copyright 2020 vs 2023 [debian/copyright:12]
P: puma source: very-long-line-length-in-source-file 1328 > 512 [docs/kubernetes.md:64]
P: puma source: very-long-line-length-in-source-file 532 > 512 [docs/rails_dev_mode.md:5]
P: puma source: very-long-line-length-in-source-file 557 > 512 [docs/signals.md:1]
P: puma source: very-long-line-length-in-source-file ... use "--tag-display-limit 0" to see all (or pipe to a file/program)

Lintian overrides are present:

$ cat debian/puma.lintian-overrides
# this is one of several sub-directories; no need to rename it
repeated-path-segment puma usr/share/doc/puma/examples/puma/

The reason is mentioned in the comment.

This package does not rely on obsolete or about to be demoted packages.

The package will not be installed by default.

Packaging and build is easy, link to d/rules:

https://git.launchpad.net/~git-ubuntu-import/ubuntu/+source/puma/tree/debian/rules

[UI standards]

Application is not end-user facing (does not need translation).

[Dependencies]

It also requires ruby-nio4r as a runtime dependency:

- ruby-nio4r MIR bug: https://bugs.launchpad.net/ubuntu/+source/ruby-nio4r/+bug/2006464

[Standards compliance]

This package correctly follows FHS and Debian Policy.

[Maintenance/Owner]
Owning Team will be Server.

Team is not yet, but will subscribe to the package before promotion.

This does not use static builds.

This does not use vendored code.

This package is not rust based.

The package has been built in the archive more recently than the last
test rebuild.

[Background information]
The Package description explains the package well.

Upstream Name is: puma.

Link to upstream project: https://github.com/puma/puma/

See original description

Tags:

CVE References

Lucas Kanashiro (lucaskanashiro) on 2023-02-07

description:

updated

Christian Ehrhardt  (paelzer) on 2023-02-07

Changed in puma (Ubuntu):
assignee:	nobody → Lukas Märdian (slyon)

Seth Arnold (seth-arnold) on 2023-02-07

tags:

added: sec-1675

Revision history for this message

Lukas Märdian (slyon) wrote on 2023-02-14:

Download full text (6.5 KiB)

Review for Package: src:puma

[Summary]
puma is a HTTP1.1 server suited for ruby integration (like with pcs).
It seems to be the most popular and production ready alternative,
besides ruby-webrick and thin. Being a web server this is very security
sensitive and has seen many CVEs in the past. Also, the server team
already maintains ruby-webrick in main, which we should get demoted
in the future. The packaging of puma should be updated to the new 6.x
upstream release.

MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

This does need a security review, so I'll assign ubuntu-security

List of specific binary packages to be promoted to main: puma
Specific binary packages built, but NOT to be promoted to main: <None>

Notes:
#0 The server team should formulate a plan of how to migrate
   from ruby-webrick to puma for its currently supported packages
   so we can demote ruby-webrick in the future (or comment on why
   this isn't possible)

Required TODOs:
#1 merge new major upstream release 6.x (at least I'd like to see a
merge from Debian experimental, ideally even the very recent 6.1
upstream release), hopefully before feature freeze
#2 get ruby-nio4r promoted (LP: #2006464)

Recommended TODOs:
#3 The package should get a team bug subscriber before being promoted
#4 both ruby-webrick and puma will be owned by the Server team.
   puma seems to be superior, can we forumlate a plan of demoting
   ruby-webrick and migrating its reverse-dependencies to puma?
#5 fix OpenSSL deprecation warnings in mini_ssl.c (upstream)
#6 improve flaky test situation
   (especially if it can lead to FTBFS, see Debian bugs below)
#7 improve on some lintian hints (see below)
#8 keep on improving and resolving the s390x test situation

[Duplication]
Problems: There is ruby-webrick in main providing the same functionality.
ruby-webrick seems to be more of a demo/development server, whereas puma seems
to be the much better and more popular choice for production use cases:
https://www.ruby-toolbox.com/categories/web_servers

There are also other HTTP servers in main, like apache. Please see the
discussion in the (deprecated) "thin" MIR for why we won't consider them
duplicates for this use case (the same arguments still hold):
https://bugs.launchpad.net/ubuntu/+source/thin/+bug/1990582/comments/1

Other suspicious packages check (not in main, but ruby-webrick):
rmadison -c main {ruby-async-http,ruby-faye-websocket,ruby-ftw,puma,thin,ruby-webrick,thin}
ruby-webrick | 1.7.0-3 | jammy-updates | source, all
ruby-webrick | 1.7.0-3 | kinetic | source, all
ruby-webrick | 1.7.0-4 | lunar | source, all
ruby-webrick | 1.8.1-1 | lunar-proposed | source, all

[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
more tests now.

Problems:
- other Dependencies to MIR due to this: ruby-nio4r (LP: #2006464)

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints ...

Review for Package: src:puma

MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.

This does need a security review, so I'll assign ubuntu-security

List of specific binary packages to be promoted to main: puma
Specific binary packages built, but NOT to be promoted to main: <None>

Required TODOs:
#1 merge new major upstream release 6.x (at least I'd like to see a
   merge from Debian experimental, ideally even the very recent 6.1
   upstream release), hopefully before feature freeze
#2 get ruby-nio4r promoted (LP: #2006464)

Other suspicious packages check (not in main, but ruby-webrick):
rmadison -c main {ruby-async-http,ruby-faye-websocket,ruby-ftw,puma,thin,ruby-webrick,thin}
 ruby-webrick | 1.7.0-3 | jammy-updates  | source, all
 ruby-webrick | 1.7.0-3 | kinetic        | source, all
 ruby-webrick | 1.7.0-4 | lunar          | source, all
 ruby-webrick | 1.8.1-1 | lunar-proposed | source, all

[Dependencies]
OK:
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems:
- other Dependencies to MIR due to this: ruby-nio4r (LP: #2006464)

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard
- Does not include vendored code

Problems: None

[Security]
OK:
- does not run a daemon as root
- does not use webkit1,2
- does not use lib*v8 directly
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)

Problems:
- history of CVEs does look concerning (some might be unresolved in universe, Debian fixed many)
- does parse data formats (HTTP) from an untrusted source.
- does not open a port/socket
- does not process arbitrary web content
- does deal with cryptography (SSL)

[Common blockers]
OK:
- does not FTBFS currently
- does have a test suite that runs at build time
  - test suite fails will fail the build upon error.
- does have a non-trivial test suite that runs as autopkgtest
  - This does not need special HW for build or test
- no new python2 dependency

Problems:
- autopkgtest regressions on s390x (to be resolved after ruby3.1 transition)

[Packaging red flags]
OK:
- Ubuntu does carry a delta, but it is reasonable and maintenance under control
- symbols tracking not applicable for this kind of code.
- d/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is OKish
- promoting this does not seem to cause issues for MOTUs that so far
  maintained the package
- d/rules is rather clean
- It is not on the lto-disabled list

Problems:
- skipping & workaround autopkgtests in Ubuntu delta (but nicely documented)
- the current release is not packaged (new major 6.x release as of October'22 - in Debian experimental, 6.1.x since February'23)
- some Lintian warnings
  - d/puma.lintian-overrides should use the new style (is being ignored)
  - W: puma: mismatched-override repeated-path-segment puma usr/share/doc/puma/examples/puma/ [usr/share/lintian/overrides/puma:2]
  - I: puma source: out-of-date-standards-version 4.6.0 (released 2021-08-18) (current is 4.6.2)
  - P: puma source: maintainer-manual-page [debian/puma.1]
  - P: puma source: maintainer-manual-page [debian/pumactl.1]
  - X: puma: executable-in-usr-lib [usr/lib/x86_64-linux-gnu/rubygems-integration/3.1.0/gems/puma-5.5.2/bin/puma] -- also pumactl, consider moving to /usr/libexec

[Upstream red flags]
OK:
- no Errors during the build
- no incautious use of malloc/sprintf (as far as we can check it) (applies to the ext/puma_http11/ extension only)
- no incautious use of malloc/sprintf (the language has no direct MM)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH
- no use of user nobody
- no use of setuid
- no dependency on webkit, qtwebkit, seed or libgoa-*
- not part of the UI for extra checks
- no translation present, but none needed for this case (user visible)?

Problems:
- Flaky tests can lead to FTBFS:
  * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031052
  * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=952741
- Warnings during build related to OpenSSL3 (in mini_ssl.c)
  * mini_ssl.c:98:3: warning: ‘DH_new’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
  * mini_ssl.c:112:3: warning: ‘DH_set0_pqg’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
  * mini_ssl.c:113:5: warning: ‘DH_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]

Changed in puma (Ubuntu):
assignee:	Lukas Märdian (slyon) → Ubuntu Security Team (ubuntu-security)

Revision history for this message

Lucas Kanashiro (lucaskanashiro) wrote on 2023-02-14:

Replying to Lukas comments:

#0: I do not think we should demote ruby-webrick, in practice, ruby-webrick is not used in production systems but it is heavily used in tests and very basic scenarios. Moving all packages depending in ruby-webrick to puma would not be easy nor maintainable in a long term. Many packages are still relying o ruby-webrick because it was part of the standard ruby library not so long ago. In short, I believe we should keep both in main (ruby-webrick and puma), I wouldn't say they support the same use cases.

#1: puma 6 is not supported by the current rails version we have in the archive. For now, I'll be merging the latest version in debian unstable. Once debian is released the rails 7 transition will start and we will be able to move to puma 6.

#2: Waiting for review.

#3: I am going to subscribe the server team.

#4: As I mentioned in #0 let's not demote ruby-webrick, they do not cover the same use cases. Moreover, libruby3.1 depends on ruby-webrick (also ruby-ethon which is part of the pcs MIR), which would pull it into main.

#5: Those fixes are present in version 6. I would prefer to wait for version 6 instead of maintaining big patches in the source package, would that be OK? If not we can try to apply the patches in the version we have.

#6: We and debian maintainers have been in touch with upstream to improve the situation of those flaky tests. In general, it is hard because our builders have some specific constraints and set of resources which is different than debian and the expectation of the upstream maintainers. I'll keep pushing this.

#7: I'll try to fix them.

#8: The test failure in s390x does not seem to get much traction with upstream, they do not have the hardware to debug it. Not sure exactly how to push this forward. At least this is a single test failure.

Revision history for this message

Mark Esler (eslerm) wrote on 2023-03-01:

Download full text (4.9 KiB)

I reviewed puma 5.6.5-3ubuntu1 as checked into lunar. This shouldn't be considered a full audit but rather a quick gauge of maintainability.

> A Ruby/Rack web server built for parallelism

- Processes spawned?
  - JRuby exec ignored for MIR
  - Puma::Launcher's use Kernel.exec() is assumed to have trusted input
    - exec set with Puma::Configuration options or ran for bundler
  - Puma::Rack arguments, --eval and --builder, are also assumed to have trusted input
- Memory management?
  - most memory use is standard Ruby, but Puma's MiniSSL contians C code in ./ext/puma_http11/
  - malloc, free, and memcpy use appear safe
- File IO?
  - quite a bit of Ruby file IO -- appears okay in input is trusted
  - chmod and chown in binder looks safe
  - see temp section below
- Logging?
  - mostly defined in Puma::CommonLogger and Puma::ErrorLogger which other files build on
    - Puma::CommonLogger attempts to use built in logger, but it appears other loggers like Rack::CommonLogger
    - Puma::ErrorLogger appears t...

I reviewed puma 5.6.5-3ubuntu1 as checked into lunar. This shouldn't be considered a full audit but rather a quick gauge of maintainability.

> A Ruby/Rack web server built for parallelism

- CVE History:
  - 9 past CVEs (not 12)
    - CVE-2019-16770, CVE-2020-5247, CVE-2020-5249, CVE-2020-11076, CVE-2020-11077, CVE-2021-29509, CVE-2021-41136, CVE-2022-23634, and CVE-2022-24790
    - https://github.com/puma/puma/security/advisories
    - most are HTTP protocol implementation errors
  - security related issues in History.md
  - project has a Security Policy and publishes Security Advisories \o/
  - upstream has a history of making security patches for the current and previous major version \o/
  - GitHub issue and PR tracker are well maintained
  - https://github.com/puma/puma/issues/2789 needs to be resolved
  - Puma::MiniSSL is middleware for OpenSSL
    - https://github.com/puma/puma/issues/2188
    - "Puma has not active maintainer for it's Java code."
  - note that https://github.com/puma/puma/issues/2081 is not inherently a security issue
- Build-Depends?
  - lunar main
     - debhelper-compat (debhelper)
     - curl
     - libssl-dev (openssl)
     - rake
     - ruby-minitest-stub-const (ruby)
  - lunar universe
     - gem2deb
     - ruby-nio4r (in MIR)
     - ruby-ffi (in MIR)
     - ruby-localhost
- pre/post inst/rm scripts?
  - none
- init scripts?
  - none
- systemd units?
  - ./lib/puma/systemd.rb
  - initiliazes Puma by triggering Puma::Events to manage Puma:Server
  - SdNotify.watchdog optionally implemented for keep-alive notifications
  - intervable can be set with ENV WATCHDOG_USEC
- dbus services?
  - none
- setuid binaries?
  - none
- binaries in PATH?
  - ./usr/bin/puma
  - ./usr/bin/pumactl
  - ./usr/lib/x86_64-linux-gnu/rubygems-integration/3.1.0/gems/puma-5.6.5/bin/puma
  - ./usr/lib/x86_64-linux-gnu/rubygems-integration/3.1.0/gems/puma-5.6.5/bin/pumactl
- sudo fragments?
  - none
- polkit files?
  - none
- udev rules?
  - none
- unit tests / autopkgtests?
  - contains build tests
    - some tests are, reasonably, skipped for missing optional dependencies
    - two tests skipped for "failing in Ubuntu autopkgtest env"
      - looks o-k from changelog notes
  - arm64 no longer passes autopkgtests as reported in initial MIR
- cron jobs?
  - none
- Build logs:
  - nothing beyond MIR Team's lintian findings
 
- Processes spawned?
  - JRuby exec ignored for MIR
  - Puma::Launcher's use Kernel.exec() is assumed to have trusted input
    - exec set with Puma::Configuration options or ran for bundler
  - Puma::Rack arguments, --eval and --builder, are also assumed to have trusted input
- Memory management?
  - most memory use is standard Ruby, but Puma's MiniSSL contians C code in ./ext/puma_http11/
  - malloc, free, and memcpy use appear safe
- File IO?
  - quite a bit of Ruby file IO -- appears okay in input is trusted
  - chmod and chown in binder looks safe
  - see temp section below
- Logging?
  - mostly defined in Puma::CommonLogger and Puma::ErrorLogger which other files build on
    - Puma::CommonLogger attempts to use built in logger, but it appears other loggers like Rack::CommonLogger
    - Puma::ErrorLogger appears to connect to stdout and stdio
  - client_error's ConnectionError and EOFERROR are discarded/not logged
  - has some debug settings
  - Ruby and C logging looks sane
- Environment variable usage?
  - fine if input trusted
    - safe assumption as untrusted input likely means attacker controls configs
  - mostly used in server launch
- Use of privileged functions?
  - none
- Use of cryptography / random number sources etc?
  - Puma's MiniSSL is middleware to OpenSSL
    - MiniSSL is written in C and Ruby
    - see discussion on replacing MiniSSL: https://github.com/puma/puma/issues/2188
    - from dev comments, Puma does not want the burden of maintaining MiniSSL and consider it a risky feature to support
    - 60 lines contain "SSL" in History.md--high maintenance cost
  - Security Team recommends against using MiniSSL
- Use of temp files?
  - contains plugin where server is restarted if ./tmp/restart.txt is touched
- Use of networking?
  - heavy use
  - default binding to 0.0.0.0
  - networking files such as Puma::DSL and Puma::Server are well documented with inline comments
  - past CVEs mostly relate to HTTP protocol implementation
- Use of WebKit?
  - none
- Use of PolicyKit?
  - none

- Any significant cppcheck results?
  - none
- Any significant Coverity results?
  - results of puma_parser_finish() not used in HttpParser_finish()
  - tools/Dockerfile runs as the default user, root
    - not a concern for MIR
  - results from a Coverity run in September 2022 have been resolved \o/
- Any significant shellcheck results?
  - not significant
- Any significant bandit results?
  - none
- Any significant rubocop results?
  - evals in lib/puma/rack/builder.rb
    - see processes spawned section above

Security team ACK for promoting puma to main.

Changed in puma (Ubuntu):
assignee:	Ubuntu Security Team (ubuntu-security) → nobody
status:	New → In Progress

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2023-03-15:

Showing up in component mismatch now as planned.

Changed in puma (Ubuntu):
status:	In Progress → Fix Committed

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2023-03-15:

Promoted together with the full PCS stack, details see https://bugs.launchpad.net/ubuntu/+source/pcs/+bug/1953341/comments/13

Changed in puma (Ubuntu):
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

debbugs #1031052
[open important] Edit
debbugs #952741
[forwarded important fixed-upstream sid ftbfs experimental bullseye] Edit
auto-github-puma-puma #2081
[open feature] Edit
auto-github-puma-puma #2188
[open perf jruby c-ext] Edit
auto-github-puma-puma #2789
[open bug contrib-wanted] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntupuma package

[MIR] Promote puma to main as a pcs dependency

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
puma package