Vulnerability · Published May 22, 2020 · Assigned by GitHub_M
CVE-2020-11076HTTP Smuggling via Transfer-Encoding Header in Puma
High 7.5
In plain English
A high-severity security flaw in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)4.1%top 9.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | puma | 4.3.6-1 | DEBIAN-CVE-2020-11076 |
| Debian:13 | puma | 4.3.6-1 | DEBIAN-CVE-2020-11076 |
| Debian:14 | puma | 4.3.6-1 | DEBIAN-CVE-2020-11076 |
| RubyGems | puma | 3.12.5 | GHSA-x7jg-6pwg-fx5h |
| RubyGems | puma | 4.3.4 | GHSA-x7jg-6pwg-fx5h |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h x_refsource_CONFIRM
- https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22 x_refsource_MISC
- https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd x_refsource_MISC
- openSUSE-SU-2020:0990 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1001 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-fe354f24e8 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20201007 [SECURITY] [DLA 2398-1] puma security update mailing-list, x_refsource_MLIST