The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c393b8b2fb advisory.

  - Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited     incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in     a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the     web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked     transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been     addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-40175)

  - Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma     exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP     request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker     could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in     versions 6.4.2 and 5.6.8. (CVE-2024-21647)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6682-1 advisory.

  - In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid     transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. (CVE-2020-11076)

  - In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the     proxy to send a response back to another unknown client. If the proxy uses persistent connections and the     client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body.
    Puma, however, would see it as two requests, and when processing the second request, send back a response     that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another     request for a different client, the second response from the first client will be sent to the second     client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in     Puma 3.12.6 and Puma 4.3.5. (CVE-2020-11077)

  - Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not     always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body     being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of     these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information     leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions     7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the     vulnerability. (CVE-2022-23634)

  - Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using     Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230     standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow     requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and     4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of     Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
    (CVE-2022-24790)

  - Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited     incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in     a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the     web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked     transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been     addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade.
    There are no known workarounds for this vulnerability. (CVE-2023-40175)

  - Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma     exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP     request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker     could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in     versions 6.4.2 and 5.6.8. (CVE-2024-21647)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6597-1 advisory.

  - Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma     exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP     request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker     could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in     versions 6.4.2 and 5.6.8. (CVE-2024-21647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2010 advisory.

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

    Security fixes:
    * python-pygments: ReDoS in pygments (CVE-2022-40896)
    * python-pycryptodomex: Side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex     (CVE-2023-52323)
    * satellite: Arithmetic overflow in satellite (CVE-2023-4320)
    * automation-hub: Ansible Automation Hub: insecure galaxy-importer tarfile extraction (CVE-2023-5189)
    * jetty: Improper addition of quotation marks to user inputs in CgiServlet (CVE-2023-36479)
    * python-aiohttp: HTTP request smuggling via llhttp HTTP request parser (CVE-2023-37276)
    * rubygem-activesupport: File Disclosure of Locally Encrypted Files (CVE-2023-38037)
    * jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)
    * python-django: Potential denial of service vulnerability in `django.utils.encoding.uri_to_iri()`     (CVE-2023-41164)
    * python-django: Denial-of-service possibility in django.utils.text.Truncator (CVE-2023-43665)
    * python-aiohttp: Numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * python-aiohttp: HTTP request modification (CVE-2023-49081)
    * python-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client (CVE-2023-49082)
    * rubygem-puma: HTTP request smuggling when parsing chunked Transfer-Encoding Bodies (CVE-2024-21647)
    * rubygem-audited: Race condition can lead to audit logs being incorrectly attributed to the wrong user     (CVE-2024-22047)
    * python-jinja2: HTML attribute injection when passing user input as keys to xmlattr filter     (CVE-2024-22195)
    * python-aiohttp: Follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python-aiohttp: HTTP request smuggling (CVE-2024-23829)

    Additional Changes:
    This update also fixes several bugs and adds various enhancements.

    Documentation for these changes is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
194662	Fedora 40 : rubygem-puma (2024-c393b8b2fb)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	critical
191720	Ubuntu 20.04 LTS / 22.04 LTS : Puma vulnerabilities (USN-6682-1)	Nessus	Ubuntu Local Security Checks	3/7/2024	3/7/2024	critical
189520	Ubuntu 23.04 / 23.10 : Puma vulnerability (USN-6597-1)	Nessus	Ubuntu Local Security Checks	1/25/2024	1/25/2024	high
199805	RHEL 8 : Satellite 6.15.0 (Important) (RHSA-2024:2010)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high

Detections

Analytics

Plugins Search

critical

critical

high

high