216.73.216.133

CVE-2024-45614

· Published 19/09/2024 23:15 · Modified 26/09/2024 13:28

Labels: CVE-2024-45614 2024-09-19CVE-2024-45614CWE-444CWE-639[email protected]

Essential information

Published
19/09/2024 23:15
Modified
26/09/2024 13:28
Author
Creator
CVSS
5.4 MEDIUM (v3.1)
CISA KEV
No
CWE
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS metrics

Description

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.

NVD status

Status
Analyzed — CVE has had analysis completed and all data associations made.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
puma / puma cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*
puma / puma cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*

References