📂 Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
| CVE-2024-21647 |
🔴 High |
8.2 |
Not Defined |
2.7% |
puma-6.4.0.gem |
Direct |
puma - 5.6.8,6.4.2 |
✅ |
| CVE-2024-45614 |
🟠 Medium |
6.3 |
Not Defined |
< 1% |
puma-6.4.0.gem |
Direct |
puma - 5.6.9,6.4.3 |
✅ |
Details
🔴CVE-2024-21647
Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Dependency Hierarchy:
- ❌ puma-6.4.0.gem (Vulnerable Library)
Vulnerability Details
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.
Publish Date: Jan 08, 2024 01:45 PM
URL: CVE-2024-21647
Threat Assessment
Exploit Maturity:Not Defined
EPSS:2.7%
Score: 8.2
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-21647
Release Date: Jan 08, 2024 01:45 PM
Fix Resolution : puma - 5.6.8,6.4.2
🟠CVE-2024-45614
Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Dependency Hierarchy:
- ❌ puma-6.4.0.gem (Vulnerable Library)
Vulnerability Details
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Publish Date: Sep 19, 2024 10:42 PM
URL: CVE-2024-45614
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 6.3
Suggested Fix
Type: Upgrade version
Origin: GHSA-9hf4-67fc-4vf4
Release Date: Sep 19, 2024 10:42 PM
Fix Resolution : puma - 5.6.9,6.4.3
📂 Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Findings
Details
🔴CVE-2024-21647
Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Dependency Hierarchy:
Vulnerability Details
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.
Publish Date: Jan 08, 2024 01:45 PM
URL: CVE-2024-21647
Threat Assessment
Exploit Maturity:Not Defined
EPSS:2.7%
Score: 8.2
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-21647
Release Date: Jan 08, 2024 01:45 PM
Fix Resolution : puma - 5.6.8,6.4.2
🟠CVE-2024-45614
Vulnerable Library - puma-6.4.0.gem
Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.
Library home page: https://rubygems.org/gems/puma-6.4.0.gem
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /vendor/cache/puma-6.4.0.gem
Dependency Hierarchy:
Vulnerability Details
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Publish Date: Sep 19, 2024 10:42 PM
URL: CVE-2024-45614
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 6.3
Suggested Fix
Type: Upgrade version
Origin: GHSA-9hf4-67fc-4vf4
Release Date: Sep 19, 2024 10:42 PM
Fix Resolution : puma - 5.6.9,6.4.3