#What is slowloris attack Patch#

The fix is very small and a git patch is available for those using unsupported versions of Puma. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. Setting `queue_requests false` also fixes the issue. This problem has been fixed in `puma` 4.3.8 and 5.3.1. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. The fix for CVE-2019-16770 was incomplete. Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. This can cause the Admin Console to become unresponsive. IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place.

What is slowloris attack