Bug 2232729 (CVE-2023-40175)

Summary:	CVE-2023-40175 rubygem-puma: HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amasferr, bbuckingham, bcourt, caswilli, chazlett, ehelms, jsherril, kaycoth, lzap, mhulan, mkudlej, nmoumoul, orabin, pcreech, rchan, sthirugn, tjochec, vkrizan, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	puma 6.3.1, puma 5.6.7	Doc Type:	If docs needed, set a value
Doc Text:	An HTTP request smuggling attack vulnerability was found in Rubygem Puma. This flaw allows an attacker to gain unauthorized access to sensitive data due to an inconsistent interpretation of HTTP requests.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2232730, 2232731, 2232732, 2232733, 2235331, 2235332
Bug Blocks:	2232734

Description TEJ RATHI 2023-08-18 08:38:26 UTC

Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

Affects versions 6.3.0 and prior, 5.6.6 and prior.

https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8
https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a (commit)
https://github.com/puma/puma/commit/e7fa02c1757ce82007fadabc2a0c33b96990dddc (release_notes v6.3.1)
https://github.com/puma/puma/commit/99da3a9866fb17019136c654f43a7b4c2ea4139e (release_notes v5.6.7)

Comment 2 ybuenos 2023-08-28 13:40:31 UTC

Created rubygem-puma tracking bugs for this issue:

Affects: fedora-37 [bug 2235331]
Affects: fedora-38 [bug 2235332]

Comment 3 errata-xmlrpc 2024-02-13 14:42:45 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797