CVE-2024-21647

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93	Patch
https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puma:puma::::::ruby::*
	cpe:2.3:a:puma:puma::::::ruby::*

History

No history.

Information

Published : 2024-01-08 14:15

Updated : 2024-01-11 17:31

NVD link : CVE-2024-21647

Mitre link : CVE-2024-21647

CVE.ORG link : CVE-2024-21647

JSON object : View

Products Affected

puma

puma

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2024-21647", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2024-01-08T14:15:47.640", "references": [{"url": "https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.\n\n"}, {"lang": "es", "value": "Puma es un servidor web para aplicaciones Ruby/Rack creado para el paralelismo. Antes de la versi\u00f3n 6.4.2, Puma exhib\u00eda un comportamiento incorrecto al analizar cuerpos de codificaci\u00f3n de transferencia fragmentados de una manera que permit\u00eda el contrabando de solicitudes HTTP. Las versiones fijas limitan el tama\u00f1o de las extensiones de fragmentos. Sin este l\u00edmite, un atacante podr\u00eda provocar un consumo ilimitado de recursos (CPU, ancho de banda de red). Esta vulnerabilidad se ha solucionado en las versiones 6.4.2 y 5.6.8."}], "lastModified": "2024-01-11T17:31:54.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "A4C4E799-9F02-4DF4-A3C3-8A7DA1B86BFE", "versionEndExcluding": "5.6.8"}, {"criteria": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "9729F4C2-7642-400E-B88A-154E29A8CA2C", "versionEndExcluding": "6.4.2", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}