CVE-2022-24790
Summary
| CVE | CVE-2022-24790 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-03-30 22:15:00 UTC |
|---|
| Updated | 2023-11-07 03:44:00 UTC |
|---|
| Description | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 37 Update: rubygem-puma-5.6.5-1.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Puma: Multiple Vulnerabilities (GLSA 202208-28) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 36 Update: rubygem-puma-5.5.2-3.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 3083-1] puma security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 35 Update: rubygem-puma-4.3.6-5.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: rubygem-puma-4.3.6-5.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 36 Update: rubygem-puma-5.5.2-3.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Debian -- Security Information -- DSA-5146-1 puma |
DEBIAN |
www.debian.org |
|
| [SECURITY] Fedora 37 Update: rubygem-puma-5.6.5-1.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma · Advisory · puma/puma · GitHub |
CONFIRM |
github.com |
|
| Merge pull request from GHSA-h99w-9q5r-gjq9 · puma/puma@5bb7d20 · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179344 Debian Security Update for puma (DSA 5146-1)
- 180972 Debian Security Update for puma (DLA 3083-1)
- 183863 Debian Security Update for puma (CVE-2022-24790)
- 200174 Ubuntu Security Notification for Puma Vulnerabilities (USN-6682-1)
- 240926 Red Hat Update for Satellite 6.9.10 (RHSA-2022:8532)
- 283093 Fedora Security Update for rubygem (FEDORA-2022-de968d1b6c)
- 283094 Fedora Security Update for rubygem (FEDORA-2022-52d0032596)
- 354428 Amazon Linux Security Advisory for rubygem-puma : ALAS2022-2022-051
- 710598 Gentoo Linux Puma Multiple Vulnerabilities (GLSA 202208-28)
- 753405 SUSE Enterprise Linux Security Update for rubygem-puma (SUSE-SU-2022:3571-1)
