Inconsistent interpretation of HTTP requests in Puma - CVE-2023-40175

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82971

Inconsistent interpretation of HTTP requests in Puma - CVE-2023-40175

Published: November 10, 2023


Vulnerability identifier: #VU82971
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-40175
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests when parsing chunked transfer encoding bodies and zero-length Content-Length headers. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.


Affected software

Puma
SUSE Enterprise Server 15 SP3 Business Critical
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
Ubuntu
openEuler
Fedora
Red Hat Satellite
puma (Ubuntu package)
satellite-convert2rhel-toolkit (Red Hat package)
rubygem-grpc (Red Hat package)
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
rubygem-google-protobuf (Red Hat package)
candlepin (Red Hat package)
ruby2.5-rubygem-puma-doc
rubygem-puma-debugsource
ruby2.5-rubygem-puma
ruby2.5-rubygem-puma-debuginfo
rubygem-katello (Red Hat package)
rubygem-puma
rubygem-puma-doc
rubygem-puma-debuginfo
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)

How to mitigate CVE-2023-40175

Install updates from vendor's website.

Puma - addressed in versions 5.6.7, 6.3.1
Red Hat Satellite - update to 6.14.2
puma (Ubuntu package) - addressed in versions Ubuntu Pro, 5.6.5-3ubuntu1.1
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
foreman-installer (Red Hat package) - update to 3.7.0.7-1.el8sat
foreman (Red Hat package) - update to 3.7.0.11-2.el8sat
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
ruby2.5-rubygem-puma-doc - addressed in versions 4.3.12-150000.3.12.1, 5.6.9-150600.18.3.1
rubygem-puma-debugsource - addressed in versions 4.3.12-150000.3.12.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1
ruby2.5-rubygem-puma - addressed in versions 4.3.12-150000.3.12.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1
ruby2.5-rubygem-puma-debuginfo - addressed in versions 4.3.12-150000.3.12.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1
rubygem-katello (Red Hat package) - update to 4.9.0.21-1.el8sat
rubygem-puma - update to 5.6.5-3
rubygem-puma-doc - update to 5.6.5-3
rubygem-puma-debugsource - update to 5.6.5-3
rubygem-puma-debuginfo - update to 5.6.5-3
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-puma - update to 6.4.2-1.fc40
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - update to 6.14.2-1.el8sat
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
rubygem-foreman_bootdisk (Red Hat package) - update to 21.2.1-1.el8sat

External References

Related Security Bulletins