Skip to content
OpenAdvisories
Medium USN-7031-2 1 CVE

puma vulnerability

Published Sep 24, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-7031-1 fixed CVE-2024-45614 in Puma for Ubuntu 24.04 LTS.
This update fixes the CVE for Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Puma incorrectly handled parsing certain headers.
A remote attacker could possibly use this issue to overwrite header values
set by intermediate proxies by providing duplicate headers containing
underscore characters.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS puma 3.12.4-1ubuntu2+esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS puma 5.5.2-2ubuntu2+esm2

Vulnerabilities 1

  • Medium 5.4
    CVE-2024-45614 Public exploit

    Header normalization allows for client to clobber proxy set headers in Puma

    Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy se…

    puma puma puma puma Debian Ubuntu Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2024-45614