USN-7031-1: Puma vulnerability
24 September 2024
Puma could be made to overwrite headers if it received specially crafted network traffic.
Releases
Packages
- puma - threaded HTTP 1.1 server for Ruby/Rack applications
Details
It was discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could possibly use this issue to overwrite header values
set by intermediate proxies by providing duplicate headers containing
underscore characters.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-7031-2: puma