Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3947 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3947-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     November 06, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : puma     Version        : 4.3.8-1+deb11u3     CVE ID         : CVE-2024-21647 CVE-2024-45614


    Two vulnerabilities have been fixed in puma, a threaded HTTP server     for Ruby/Rack applications.

    CVE-2024-21647

        Incorrect behavior when parsing chunked transfer encoding bodies         in a way that allowed HTTP request smuggling. Fixed versions         limits the size of chunk extensions. Without this limit, an         attacker could cause unbounded resource (CPU, network bandwidth)         consumption.

    CVE-2024-45614

        Clients could clobber values set by intermediate proxies (such as         X-Forwarded-For) by providing a underscore version of the same         header (X-Forwarded_For). Any users relying on proxy set variables         is affected.

    For Debian 11 bullseye, these problems have been fixed in version     4.3.8-1+deb11u3.

    We recommend that you upgrade your puma packages.

    For the detailed security status of puma please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/puma

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3644-1 advisory.

    - CVE-2024-45614: Prevent underscores from clobbering hyphen headers (bsc#1230848).
    - CVE-2024-21647: Fixed DoS when parsing chunked Transfer-Encoding bodies (bsc#1218638).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2010 advisory.

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

    Security fixes:
    * python-pygments: ReDoS in pygments (CVE-2022-40896)
    * python-pycryptodomex: Side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex     (CVE-2023-52323)
    * satellite: Arithmetic overflow in satellite (CVE-2023-4320)
    * automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile extraction (CVE-2023-5189)
    * jetty: Improper addition of quotation marks to user inputs in CgiServlet (CVE-2023-36479)
    * python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276)
    * rubygem-activesupport: File Disclosure of Locally Encrypted Files (CVE-2023-38037)
    * jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
    * python-django: Potential denial of service vulnerability in `django.utils.encoding.uri_to_iri()`     (CVE-2023-41164)
    * python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665)
    * python-aiohttp: Numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * python-aiohttp: HTTP request modification (CVE-2023-49081)
    * python-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082)
    * rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies (CVE-2024-21647)
    * rubygem-audited: Race condition can lead to audit logs being incorrectly attributed to the wrong user     (CVE-2024-22047)
    * python-jinja2: HTML attribute injection when passing user input as keys to xmlattr filter     (CVE-2024-22195)
    * python-aiohttp: Follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python-aiohttp: HTTP request smuggling (CVE-2024-23829)

    Additional Changes:
    This update also fixes several bugs and adds various enhancements.

    Documentation for these changes is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c393b8b2fb advisory.

    Automatic update for rubygem-puma-6.4.2-1.fc40.

    ##### **Changelog**

    ```
    * Tue Jan  9 2024 Vt Ondruch <vondruch@redhat.com> - 6.4.2-1
    - Update to Puma 6.4.2.
      Resolves: rhbz#2134670       Resolves: rhbz#2235332       Related: rhbz#2232729       Resolves: rhbz#2257341       Related: rhbz#2257340

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6682-1 advisory.

    ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could     possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04     LTS. (CVE-2020-11076)

    It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly     use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS.
    (CVE-2020-11077)

    Jean Boussier discovered that Puma might not always release resources properly after handling HTTP     requests. A remote attacker could possibly use this issue to read sensitive information. (CVE-2022-23634)

    It was discovered that Puma incorrectly handled certain malformed headers. A remote attacker could use     this issue to perform an HTTP Request Smuggling attack. (CVE-2022-24790)

    Ben Kallus discovered that Puma incorrectly handled parsing certain headers. A remote attacker could use     this issue to perform an HTTP Request Smuggling attack. (CVE-2023-40175)

    Bartek Nowotarski discovered that Puma incorrectly handled parsing certain encoded content. A remote     attacker could possibly use this to cause a denial of service. (CVE-2024-21647)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6597-1 advisory.

    It was discovered that Puma incorrectly handled parsing chunked transfer encoding bodies. A remote     attacker could possibly use this issue to cause Puma to consume resources, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210422	Debian dla-3947 : puma - security update	Nessus	Debian Local Security Checks	medium
209199	SUSE SLES15 / openSUSE 15 Security Update : rubygem-puma (SUSE-SU-2024:3644-1)	Nessus	SuSE Local Security Checks	medium
199805	RHEL 8 : Satellite 6.15.0 (Important) (RHSA-2024:2010)	Nessus	Red Hat Local Security Checks	high
194662	Fedora 40 : rubygem-puma (2024-c393b8b2fb)	Nessus	Fedora Local Security Checks	critical
191720	Ubuntu 20.04 LTS / 22.04 LTS : Puma vulnerabilities (USN-6682-1)	Nessus	Ubuntu Local Security Checks	critical
189520	Ubuntu 23.04 / 23.10 : Puma vulnerability (USN-6597-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2024-21647

high

Tenable Plugins

medium

medium

high

critical

critical

high