Inconsistent interpretation of HTTP requests in Puma - CVE-2024-45614

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU97643

Inconsistent interpretation of HTTP requests in Puma - CVE-2024-45614

Published: September 23, 2024


Vulnerability identifier: #VU97643
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45614
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to the header normalization allows for client to clobber proxy set headers. A remote attacker can send a specially crafted HTTP request to the server and gain access to sensitive information on the system.


Affected software

Puma
SUSE Enterprise Server 15 SP3 Business Critical
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
openEuler
Ubuntu
Log Analysis
puma (Ubuntu package)
rubygem-puma-doc
rubygem-puma-debugsource
rubygem-puma-debuginfo
rubygem-puma
ruby2.5-rubygem-puma-debuginfo
ruby2.5-rubygem-puma-doc
ruby2.5-rubygem-puma

How to mitigate CVE-2024-45614

Install updates from vendor's website.

Puma - addressed in versions 5.6.9, 6.4.3
Log Analysis - update to 1.3.8.2
puma (Ubuntu package) - addressed in versions Ubuntu Pro, 6.4.2-4ubuntu4.3
rubygem-puma-doc - addressed in versions 3.12.6-4, 5.6.5-3
rubygem-puma-debugsource - addressed in versions 3.12.6-4, 5.6.5-3
rubygem-puma-debuginfo - addressed in versions 3.12.6-4, 5.6.5-3
rubygem-puma - addressed in versions 3.12.6-4, 5.6.5-3
ruby2.5-rubygem-puma-debuginfo - addressed in versions 4.3.12-150000.3.15.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1
ruby2.5-rubygem-puma-doc - addressed in versions 4.3.12-150000.3.15.1, 5.6.9-150600.18.3.1
ruby2.5-rubygem-puma - addressed in versions 4.3.12-150000.3.15.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1
rubygem-puma-debugsource - addressed in versions 4.3.12-150000.3.15.1, 5.6.9-150000.3.18.1, 5.6.9-150600.18.3.1

External References

Related Security Bulletins