Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3947 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3947-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     November 06, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : puma     Version        : 4.3.8-1+deb11u3     CVE ID         : CVE-2024-21647 CVE-2024-45614


    Two vulnerabilities have been fixed in puma, a threaded HTTP server     for Ruby/Rack applications.

    CVE-2024-21647

        Incorrect behavior when parsing chunked transfer encoding bodies         in a way that allowed HTTP request smuggling. Fixed versions         limits the size of chunk extensions. Without this limit, an         attacker could cause unbounded resource (CPU, network bandwidth)         consumption.

    CVE-2024-45614

        Clients could clobber values set by intermediate proxies (such as         X-Forwarded-For) by providing a underscore version of the same         header (X-Forwarded_For). Any users relying on proxy set variables         is affected.

    For Debian 11 bullseye, these problems have been fixed in version     4.3.8-1+deb11u3.

    We recommend that you upgrade your puma packages.

    For the detailed security status of puma please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/puma

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3644-1 advisory.

    - CVE-2024-45614: Prevent underscores from clobbering hyphen headers (bsc#1230848).
    - CVE-2024-21647: Fixed DoS when parsing chunked Transfer-Encoding bodies (bsc#1218638).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7031-2 advisory.

    USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS. This update fixes the CVE for Ubuntu 22.04     LTS and Ubuntu 20.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7031-1 advisory.

    It was discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly     use this issue to overwrite header values set by intermediate proxies by providing duplicate headers     containing underscore characters.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210422	Debian dla-3947 : puma - security update	Nessus	Debian Local Security Checks	medium
209199	SUSE SLES15 / openSUSE 15 Security Update : rubygem-puma (SUSE-SU-2024:3644-1)	Nessus	SuSE Local Security Checks	medium
207712	Ubuntu 20.04 LTS / 22.04 LTS : Puma vulnerability (USN-7031-2)	Nessus	Ubuntu Local Security Checks	medium
207703	Ubuntu 24.04 LTS : Puma vulnerability (USN-7031-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-45614

medium

Tenable Plugins

medium

medium

medium

medium