Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3amctNnB3Zy1meDVo
HTTP Smuggling via Transfer-Encoding Header in Puma
Impact
By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.
Originally reported by @ZeddYu, who has our thanks for the detailed report.
Patches
The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Puma
- See our security policy
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3amctNnB3Zy1meDVo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 4 years ago
Updated: 11 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-x7jg-6pwg-fx5h, CVE-2020-11076
References:
- https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
- https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
- https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
- https://nvd.nist.gov/vuln/detail/CVE-2020-11076
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/
- https://lists.debian.org/debian-lts-announce/2020/10/msg00009.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-11076.yml
- https://github.com/advisories/GHSA-x7jg-6pwg-fx5h
Blast Radius: 42.1
Affected Packages
rubygems:puma
Dependent packages: 627Dependent repositories: 404,320
Downloads: 357,648,490 total
Affected Version Ranges: >= 4.0.0, < 4.3.4, < 3.12.5
Fixed in: 4.3.4, 3.12.5
All affected versions: 0.8.0, 0.8.1, 0.8.2, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.3.0, 1.3.1, 1.4.0, 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 2.9.1, 2.9.2, 2.10.0, 2.10.1, 2.10.2, 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.13.4, 2.14.0, 2.15.0, 2.15.1, 2.15.2, 2.15.3, 2.16.0, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 3.6.1, 3.6.2, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.8.2, 3.9.0, 3.9.1, 3.10.0, 3.11.0, 3.11.1, 3.11.2, 3.11.3, 3.11.4, 3.12.0, 3.12.1, 3.12.2, 3.12.4, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.3.0, 4.3.1, 4.3.3
All unaffected versions: 3.12.5, 3.12.6, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.3.12, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 5.3.2, 5.4.0, 5.5.0, 5.5.1, 5.5.2, 5.6.0, 5.6.1, 5.6.2, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0, 6.3.1, 6.4.0, 6.4.1, 6.4.2