Puma vulnerable to HTTP Request Smuggling
When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.The following vulnerabilities are addressed by this advisory:Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.Nginx (latest)Apache (latest)Haproxy 2.5+Caddy (latest)Traefik (latest)