Bugzilla – Bug 1214425
VUL-0: CVE-2023-40175: rubygem-puma: HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers
Last modified: 2023-10-04 08:32:07 UTC
CVE-2023-40175 Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Affects versions 6.3.0 and prior, 5.6.6 and prior. https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8 https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a (commit) https://github.com/puma/puma/commit/e7fa02c1757ce82007fadabc2a0c33b96990dddc (release_notes v6.3.1) https://github.com/puma/puma/commit/99da3a9866fb17019136c654f43a7b4c2ea4139e (release_notes v5.6.7) References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40175 https://bugzilla.redhat.com/show_bug.cgi?id=2232729 https://www.cve.org/CVERecord?id=CVE-2023-40175 https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
SUSE-SU-2023:3957-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1214425 CVE References: CVE-2023-40175 Sources used: openSUSE Leap 15.4 (src): rubygem-puma-4.3.12-150000.3.12.1 openSUSE Leap 15.5 (src): rubygem-puma-4.3.12-150000.3.12.1 SUSE Linux Enterprise High Availability Extension 15 SP1 (src): rubygem-puma-4.3.12-150000.3.12.1 SUSE Linux Enterprise High Availability Extension 15 SP2 (src): rubygem-puma-4.3.12-150000.3.12.1 SUSE Linux Enterprise High Availability Extension 15 SP3 (src): rubygem-puma-4.3.12-150000.3.12.1 SUSE Linux Enterprise High Availability Extension 15 SP4 (src): rubygem-puma-4.3.12-150000.3.12.1 SUSE Linux Enterprise High Availability Extension 15 SP5 (src): rubygem-puma-4.3.12-150000.3.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.