CVE-2021-41136 Information

Description

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9 using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy causing the proxy to send a response back to another unknown client. The only proxy which has this behavior as far as the Puma team is aware of is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining the proxy may mistake it as the first request’s body. Puma however would see it as two requests and when processing the second request send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround do not use Apache Traffic Server with puma.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Reference

https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx https://github.com/puma/puma/commit/acdc3ae571dfae0e045cf09a295280127db65c7f https://www.debian.org/security/2022/dsa-5146

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction Required

LOW

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

3.7