Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-c2f4-cvqm-65w2: Puma HTTP Request/Response Smuggling vulnerability

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

ghsa
#vulnerability#web#git#ruby

Package

bundler puma (RubyGems)

Affected versions

>= 6.0.0, < 6.4.2

< 5.6.8

Patched versions

6.4.2

5.6.8

Description

Impact

Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

Workarounds

No known workarounds.

References

  • HTTP Request Smuggling
  • Open an issue in Puma
  • See our security policy

References

  • GHSA-c2f4-cvqm-65w2
  • https://nvd.nist.gov/vuln/detail/CVE-2024-21647
  • puma/puma@5fc43d7
  • puma/puma@60d5ee3
  • puma/puma@bbb880f

nateberkopec published to puma/puma

Jan 8, 2024

Published by the National Vulnerability Database

Jan 8, 2024

Published to the GitHub Advisory Database

Jan 8, 2024

Reviewed

Jan 8, 2024

Related news

Red Hat Security Advisory 2024-2010-03

Red Hat Security Advisory 2024-2010-03 - An update is now available for Red Hat Satellite 6.15. The release contains a new version of Satellite and important security fixes for various components. Issues addressed include HTTP request smuggling, crlf injection, denial of service, file disclosure, and traversal vulnerabilities.

Ubuntu Security Notice USN-6682-1

Ubuntu Security Notice 6682-1 - ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS.

Ubuntu Security Notice USN-6597-1

Ubuntu Security Notice 6597-1 - It was discovered that Puma incorrectly handled parsing chunked transfer encoding bodies. A remote attacker could possibly use this issue to cause Puma to consume resources, leading to a denial of service.