Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Inconsistent Interpretation of HTTP Requests in puma
Vulnerability Description
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Vulnerability Title
Puma 环境问题漏洞
Vulnerability Description
Puma是美国Evan Phoenix个人开发者的一款针对高并发应用的Web服务器。 Puma存在环境问题漏洞，该漏洞源于在解析分块传输编码主体中的尾随字段和零长度Content-Length标头时存在安全问题。受影响的产品和版本：Puma 6.3.1之前版本，5.6.7之前版本。
CVSS Information
N/A
Vulnerability Type
N/A