Headline
Ubuntu Security Notice USN-6597-1
Ubuntu Security Notice 6597-1 - It was discovered that Puma incorrectly handled parsing chunked transfer encoding bodies. A remote attacker could possibly use this issue to cause Puma to consume resources, leading to a denial of service.
==========================================================================Ubuntu Security Notice USN-6597-1January 25, 2024puma vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 23.10- Ubuntu 23.04Summary:Puma could be made to consume resources if it received specially craftednetwork traffic.Software Description:- puma: threaded HTTP 1.1 server for Ruby/Rack applicationsDetails:It was discovered that Puma incorrectly handled parsing chunked transferencoding bodies. A remote attacker could possibly use this issue to causePuma to consume resources, leading to a denial of service.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 23.10: puma 5.6.5-4ubuntu2.1Ubuntu 23.04: puma 5.6.5-3ubuntu1.2In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6597-1 CVE-2024-21647Package Information: https://launchpad.net/ubuntu/+source/puma/5.6.5-4ubuntu2.1 https://launchpad.net/ubuntu/+source/puma/5.6.5-3ubuntu1.2Related news
Red Hat Security Advisory 2024-2010-03 - An update is now available for Red Hat Satellite 6.15. The release contains a new version of Satellite and important security fixes for various components. Issues addressed include HTTP request smuggling, crlf injection, denial of service, file disclosure, and traversal vulnerabilities.
Ubuntu Security Notice 6682-1 - ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS.
### Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ### Patches The vulnerability has been fixed in 6.4.2 and 5.6.8. ### Workarounds No known workarounds. ### References * [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling) * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)