Debian Puma vulnerabilities

CVE-2024-45614 [MEDIUM] CVE-2024-45614: puma - Puma is a Ruby/Rack web server built for parallelism. In affected versions clien... Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore versio

CVE-2024-21647 [MEDIUM] CVE-2024-21647: puma - Puma is a web server for Ruby/Rack applications built for parallelism. Prior to ... Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumpt

CVE-2023-40175 [HIGH] CVE-2023-40175: puma - Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 an... Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by eithe

CVE-2022-24790 [CRITICAL] CVE-2022-24790: puma - Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack a... Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

CVE-2022-23634 [HIGH] CVE-2022-23634: puma - Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5... Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Exe

CVE-2021-29509 [MEDIUM] CVE-2021-29509: puma - Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE... Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persisten

CVE-2021-41136 [LOW] CVE-2021-41136: puma - Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 an... Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavi

CVE-2020-11077 [HIGH] CVE-2020-11077: puma - In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request thro... In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when

CVE-2020-11076 [HIGH] CVE-2020-11076: puma - In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP res... In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. Scope: local bookworm: resolved (fixed in 4.3.6-1) bullseye: resolved (fixed in 4.3.6-1) forky: resolved (fixed in 4.3.6-1) sid: resolved (fixed in 4.3.6-1) trixie: resolved (fixed

CVE-2020-5247 [MEDIUM] CVE-2020-5247: puma - In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma a... In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an

CVE-2020-5249 [MEDIUM] CVE-2020-5249: puma - In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows u... In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, respon

CVE-2019-16770 [MEDIUM] CVE-2019-16770: puma - In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keep... In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patche