Puma is a threaded HTTP 1.1 server used for running Ruby web applications. It facilitates communication between web browsers and Ruby applications, handling incoming requests and delivering responses. Recently, the Ubuntu security team released updates to address Puma vulnerabilities in Ubuntu 22.04 LTS and Ubuntu 20.04 LTS releases. In this article, we’ll explore the specifics of these patched vulnerabilities.
A Closer Look at Puma Vulnerabilities
CVE-2020-11076 & CVE-2020-11077 (CVSS v3 Score: 7.5 High)
These vulnerabilities, discovered by ZeddYu Lu, stemmed from Puma’s incorrect handling of certain headers. A remote attacker could potentially exploit this to launch HTTP Request Smuggling attacks. This issue was specific to Ubuntu 20.04 LTS.
CVE-2022-23634 (CVSS v3 Score: 5.9 Medium)
Jean Boussier identified a situation where Puma might not properly release resources after processing HTTP requests. This vulnerability could potentially allow a remote attacker to access sensitive information.
CVE-2022-24790 (CVSS v3 Score: 7.5 High)
It was found that Puma incorrectly handled certain malformed headers. This vulnerability could be leveraged by a remote attacker to execute HTTP Request Smuggling attacks.
CVE-2023-40175 (CVSS v3 Score: 9.8 Critical)
Similar to the earlier vulnerability, Ben Kallus discovered another instance of Puma mishandling parsing certain headers. This vulnerability also could be exploited for HTTP Request Smuggling attacks.
CVE-2024-21647 (CVSS v3 Score: 7.5 High)
Bartek Nowotarski discovered that Puma incorrectly handled parsing certain encoded content. A remote attacker could potentially use this flaw to cause a denial-of-service (DoS) attack.
Conclusion
Upgrading Puma packages to the latest versions is essential to mitigate these vulnerabilities and safeguard your web applications. It’s advisable to stay updated on the latest security advisories for Puma and other critical software components to maintain a robust security posture.
To ensure the maximum protection of your Ubuntu systems, you can leverage KernelCare Enterprise live patching solution that automatically applies security patches to the running kernel without system restarts or downtime. Besides Ubuntu, KernelCare supports other popular Linux distributions including Debian, CentOS, AlmaLinux, RHEL, Rocky Linux, Oracle Linux, CloudLinux, and more.
Source: USN-6682-1
The post Multiple Puma Vulnerabilities Fixed in Ubuntu appeared first on TuxCare.
*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Rohan Timalsina. Read the original post at: https://tuxcare.com/blog/multiple-puma-vulnerabilities-fixed-in-ubuntu/