CVE-2023-40175: Inconsistent Interpretation of HTTP Requests in puma
Impact Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
The following vulnerabilities are addressed by this advisory:
Incorrect parsing of trailing fields in chunked transfer encoding bodies Parsing of blank/zero-length Content-Length headers
Patches The vulnerability has been fixed in 6.3.1 and 5.6.7.
Workarounds No known workarounds.
References HTTP Request Smuggling
For more information If you have any questions or comments about this advisory:
Open an issue in Puma See our security policy
Other sources
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
Affects versions 6.3.0 and prior, 5.6.6 and prior.
https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8 https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a (commit) https://github.com/puma/puma/commit/e7fa02c1757ce82007fadabc2a0c33b96990dddc (releasenotes v6.3.1) https://github.com/puma/puma/commit/99da3a9866fb17019136c654f43a7b4c2ea4139e (releasenotes v5.6.7)
— Red Hat
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— Ubuntu
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-40175?
CVE-2023-40175 is a vulnerability in Puma, a Ruby/Rack web server, that allows HTTP request smuggling.
How severe is CVE-2023-40175?
CVE-2023-40175 has a severity rating of 9.8, which is considered critical.
What is the impact of CVE-2023-40175?
CVE-2023-40175 allows an attacker to perform HTTP request smuggling due to incorrect parsing of chunked transfer encoding bodies and zero-length Content-Length headers.
How do I fix CVE-2023-40175?
To fix CVE-2023-40175, update Puma to version 6.3.1 or 5.6.7.
Where can I find more information about CVE-2023-40175?
More information about CVE-2023-40175 can be found in the following references: - [GitHub Advisory](https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8) - [GitHub Commit 1](https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a) - [GitHub Commit 2](https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1)