CVE-2021-41136
published 2021-10-12CVE-2021-41136: Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which…
PriorityP415low3.7CVSS 3.1
AVNACHPRLUIRSUCLILAN
EPSS
1.12%
62.5th percentile
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with `puma`.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | puma | < puma 5.5.2-1 (bookworm) | puma 5.5.2-1 (bookworm) |
| puma | puma | < 4.3.9 | 4.3.9 |
| puma | puma | <= 4.3.8 | — |
| puma | puma | — | — |
| puma | puma | >= 0 < 4.3.8-1+deb11u2 | 4.3.8-1+deb11u2 |
| puma | puma | >= 0 < 5.5.2-1 | 5.5.2-1 |
| puma | puma | >= 0 < 5.5.2-1 | 5.5.2-1 |
| puma | puma | >= 0 < 5.5.2-1 | 5.5.2-1 |
| puma | puma | >= 0 < 4.3.9 | 4.3.9 |
| puma | puma | >= 5.0.0 < 5.5.1 | 5.5.1 |
| puma | puma | 5.0.0 – 5.5.0 | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
nvdv2.03.6LOWAV:N/AC:H/Au:S/C:P/I:P/A:N
osv3.7LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
ghsa·2021-10-12
CVE-2021-41136 [LOW] CWE-444 Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
### Impact
Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.
This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.
If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing th
OSV
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
osv·2021-10-12
CVE-2021-41136 [LOW] Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
### Impact
Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.
This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.
If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing th
OSV
CVE-2021-41136: Puma is a HTTP 1
osv·2021-10-12·CVSS 3.7
CVE-2021-41136 [LOW] CVE-2021-41136: Puma is a HTTP 1
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send an
Red Hat
rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
vendor_redhat·2021-10-12·CVSS 3.7
CVE-2021-41136 [LOW] CWE-444 rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that
Debian
CVE-2021-41136: puma - Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 an...
vendor_debian·2021·CVSS 3.7
CVE-2021-41136 [LOW] CVE-2021-41136: puma - Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 an...
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send an
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/puma/puma/commit/436c71807f00e07070902a03f79fd3e130eb6b18https://github.com/puma/puma/commit/acdc3ae571dfae0e045cf09a295280127db65c7fhttps://github.com/puma/puma/commit/fb6ad8f8013ab5cdbb2f444cbfabd0b4fde71139https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xxhttps://github.com/puma/puma/commit/acdc3ae571dfae0e045cf09a295280127db65c7fhttps://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xxhttps://lists.debian.org/debian-lts-announce/2022/08/msg00015.htmlhttps://security.gentoo.org/glsa/202208-28https://www.debian.org/security/2022/dsa-5146
2021-10-12
Published