rpm package
suse/rubygem-puma&distro=SUSE Linux Enterprise High Availability Extension 15 SP3
pkg:rpm/suse/rubygem-puma&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP3
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-45614 | Med | 5.4 | < 4.3.12-150000.3.15.1 | 4.3.12-150000.3.15.1 | Sep 19, 2024 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affect | |
| CVE-2024-21647 | Med | 5.9 | < 4.3.12-150000.3.15.1 | 4.3.12-150000.3.15.1 | Jan 8, 2024 | Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without | |
| CVE-2023-40175 | Hig | 7.3 | < 4.3.12-150000.3.12.1 | 4.3.12-150000.3.12.1 | Aug 18, 2023 | Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is | |
| CVE-2022-24790 | Cri | 9.1 | < 4.3.12-150000.3.9.1 | 4.3.12-150000.3.9.1 | Mar 30, 2022 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request sta | |
| CVE-2022-23634 | Hig | 8.0 | < 4.3.11-150000.3.6.2 | 4.3.11-150000.3.6.2 | Feb 11, 2022 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to wor | |
| CVE-2021-41136 | Low | 3.7 | < 4.3.11-150000.3.6.2 | 4.3.11-150000.3.6.2 | Oct 12, 2021 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the p | |
| CVE-2021-29509 | Hig | 7.5 | < 4.3.11-150000.3.6.2 | 4.3.11-150000.3.6.2 | May 11, 2021 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threa |
- affected < 4.3.12-150000.3.15.1fixed 4.3.12-150000.3.15.1
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affect
- affected < 4.3.12-150000.3.15.1fixed 4.3.12-150000.3.15.1
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without
- affected < 4.3.12-150000.3.12.1fixed 4.3.12-150000.3.12.1
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is
- affected < 4.3.12-150000.3.9.1fixed 4.3.12-150000.3.9.1
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request sta
- affected < 4.3.11-150000.3.6.2fixed 4.3.11-150000.3.6.2
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to wor
- affected < 4.3.11-150000.3.6.2fixed 4.3.11-150000.3.6.2
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the p
- affected < 4.3.11-150000.3.6.2fixed 4.3.11-150000.3.6.2
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threa