CVE-2024-52796
1 advisory.
RubyGems/pwpush CVE-2024-52796: medium 5.3, EPSS 0.54%
Password Pusher rate limiter can be bypassed by forging proxy headers
Action: Upgrade pwpush to 1.49.0 or later.
bundle update pwpushAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.49.0 | - |
Fixed versions
| 1.49.0 |
Sources
- osv: GHSA-ffp2-8p2h-4m5j
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j
- https://nvd.nist.gov/vuln/detail/CVE-2024-52796
- https://docs.pwpush.com/docs/proxies/#trusted-proxies
- https://github.com/pglombardo/PasswordPusher
- https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pwpush/CVE-2024-52796.yml
CVE-2024-52796 · published · modified · JSON