CVE-2024-21647

2024-01-0800:00:00

ubuntu.com

puma

http request smuggling

version 6.4.2

version 5.6.8

chunked transfer encoding

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

11.9%

JSON

Puma is a web server for Ruby/Rack applications built for parallelism.
Prior to version 6.4.2, puma exhibited incorrect behavior when parsing
chunked transfer encoding bodies in a way that allowed HTTP request
smuggling. Fixed versions limits the size of chunk extensions. Without this
limit, an attacker could cause unbounded resource (CPU, network bandwidth)
consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchpuma< 3.12.4-1ubuntu2+esm1UNKNOWN
ubuntu22.04noarchpuma< 5.5.2-2ubuntu2+esm1UNKNOWN
ubuntu23.04noarchpuma< 5.6.5-3ubuntu1.2UNKNOWN
ubuntu23.10noarchpuma< 5.6.5-4ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	puma	< 3.12.4-1ubuntu2+esm1	UNKNOWN
ubuntu	22.04	noarch	puma	< 5.5.2-2ubuntu2+esm1	UNKNOWN
ubuntu	23.04	noarch	puma	< 5.6.5-3ubuntu1.2	UNKNOWN
ubuntu	23.10	noarch	puma	< 5.6.5-4ubuntu2.1	UNKNOWN