Vulnerability: Information Exposure when using Puma with Rails ### Impact
Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.

From Rails:

> Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

### Patches
This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: 
https://github.com/advisories/GHSA-wh98-p28r-vrc9 
for details about the rails vulnerability

Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

### Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1) includes a middleware that can be used instead.

### References

* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability ID: GHSA-rmj8-8hhh-gv5h
CWE: CWE-200
Severity score: 8
Project: https://github.com/puma/puma
Published: 2022-02-11
File: lib/puma/request.rb
Commit message: Ensure `close` is called on the response body no matter what

Another fallout from https://github.com/puma/puma/pull/2809 is that
in some cases the `res_body.close` wasn't called because some previous code
raised.

For Rails apps it means CurrentAttributes and a few other important
states aren't reset properly.

This is being improved on the Rails side too, but I believe it would
be good to harden this on the puma side as well.
Commit author: Jean Boussier

Vulnerable version (before fix):
 def handle_request(client, lines, requests)         end        ensure         uncork_socket io          body.close         client.tempfile.unlink if client.tempfile         res_body.close if res_body.respond_to? :close          after_reply.each { |o| o.call }       end

Fixed version (after fix):
 def handle_request(client, lines, requests)         end        ensure         begin           uncork_socket io            body.close           client.tempfile.unlink if client.tempfile         ensure           # Whatever happens, we MUST call `close` on the response body.           # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks           res_body.close if res_body.respond_to? :close         end          after_reply.each { |o| o.call }       end

Patch:
patch: @@ -171,11 +171,16 @@ def handle_request(client, lines, requests)
         end
 
       ensure
-        uncork_socket io
-
-        body.close
-        client.tempfile.unlink if client.tempfile
-        res_body.close if res_body.respond_to? :close
+        begin
+          uncork_socket io
+
+          body.close
+          client.tempfile.unlink if client.tempfile
+        ensure
+          # Whatever happens, we MUST call `close` on the response body.
+          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end
path: lib/puma/request.rb