Log in Start free

Vulnerability · Published Mar 2, 2020 · Assigned by GitHub_M

CVE-2020-5249HTTP Response Splitting (Early Hints) in Puma

Medium 6.5

In plain English

A medium-severity security flaw in Puma from puma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.6%top 24.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12puma3.12.4-1DEBIAN-CVE-2020-5249
Debian:13puma3.12.4-1DEBIAN-CVE-2020-5249
Debian:14puma3.12.4-1DEBIAN-CVE-2020-5249
RubyGemspuma3.12.4GHSA-33vf-4xgg-9r58
RubyGemspuma4.3.3GHSA-33vf-4xgg-9r58

Affected products (as reported)

VendorProductVersions
puma Puma < 3.12.4>= 4.0.0, < 4.3.3

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References