GHSA-h99w-9q5r-gjq9

    Dashboard / Vulnerabilities / GHSA-h99w-9q5r-gjq9

    GHSA-h99w-9q5r-gjq9

    Published: 30 Mar 2022Last Modified: 16 Feb 2024

    Summary: Puma vulnerable to HTTP Request Smuggling

    Details: When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following vulnerabilities are addressed by this advisory: - Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`. - Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed. - Lenient parsing of duplicate `Content-Length` headers, when they should be rejected. - Lenient parsing of the ending of chunked segments, when they should end with `\r\n`. The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves. - Nginx (latest) - Apache (latest) - Haproxy 2.5+ - Caddy (latest) - Traefik (latest)

    References: https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9, https://nvd.nist.gov/vuln/detail/CVE-2022-24790, https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5, https://github.com/puma/puma, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2022-24790.yml, https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html, https://lists.fedoraproject.org/archives/list/[email protected]/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5, https://lists.fedoraproject.org/archives/list/[email protected]/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G, https://lists.fedoraproject.org/archives/list/[email protected]/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB, https://portswigger.net/web-security/request-smuggling, https://security.gentoo.org/glsa/202208-28, https://www.debian.org/security/2022/dsa-5146

    Affected packages

    Package

    Name: puma

    Purl: pkg:gem/puma

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 5.0.0
    Fixed -5.6.4

    Affected versions

    5.0.0
    5.0.1
    5.0.2
    5.0.3
    5.0.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h99w-9q5r-gjq9 | CVE-DB