Log in Start free

Vulnerability · Published May 22, 2020 · Assigned by GitHub_M

CVE-2020-11077HTTP Smuggling via Transfer-Encoding Header in Puma

Medium 6.8

In plain English

A medium-severity security flaw in puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)2.9%top 13.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12puma4.3.6-1DEBIAN-CVE-2020-11077
Debian:13puma4.3.6-1DEBIAN-CVE-2020-11077
Debian:14puma4.3.6-1DEBIAN-CVE-2020-11077
RubyGemspuma3.12.6GHSA-w64w-qqph-5gxm
RubyGemspuma4.3.5GHSA-w64w-qqph-5gxm

Affected products (as reported)

VendorProductVersions
puma puma < 3.12.6>= 4.0.0, < 4.3.5

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

References