CVE-2023-40175 Inconsistent Interpretation of HTTP Requests in puma
Attackers can exploit HTTP request smuggling in Puma via inconsistent parsing of chunked bodies or zero-length headers, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40175?
CVE-2023-40175 is a high-severity vulnerability in puma, published on 18 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-444
Which versions are affected by CVE-2023-40175?
4 open source packages ship an affected version, including puma. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
puma RubyGems | All versions | 5.6.7 |
puma RubyGems | All versions | 5.6.7 |
puma RubyGems | From 6.0.0 | 6.3.1 |
puma RubyGems | From 6.0.0 | 6.3.1 |
Linux distribution packages (7)
rubygem-puma SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma SUSE:Linux Enterprise High Availability Extension 15 SP3 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma SUSE:Linux Enterprise High Availability Extension 15 SP5 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma openSUSE:Leap 15.4 | All versions | 4.3.12-150000.3.12.1 |
rubygem-puma openSUSE:Leap 15.5 | All versions | 4.3.12-150000.3.12.1 |
Products include Puma Puma.
How do I fix CVE-2023-40175?
Upgrade puma to a fixed version for your release line: 5.6.7 or 6.3.1.
Is CVE-2023-40175 being exploited?
There is no known exploitation of CVE-2023-40175 in the wild and no public exploit code.
Other vulnerabilities in puma
Sources
Also known as DEBIAN-CVE-2023-40175, GHSA-68xg-gqqm-vgj8, SUSE-SU-2023:3957-1, UBUNTU-CVE-2023-40175.