Lucene search

GoogleOSV:GHSA-X7JG-6PWG-FX5H

HistoryMay 22, 2020 - 2:55 p.m.

HTTP Smuggling via Transfer-Encoding Header in Puma

2020-05-2214:55:05

Google

osv.dev

0.005 Low

EPSS

Percentile

77.4%

By using an invalid transfer-encoding header, an attacker could smuggle an HTTP response.

Originally reported by @ZeddYu, who has our thanks for the detailed report.

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

If you have any questions or comments about this advisory:

CPENameOperatorVersion
pumaeq3.11.1
pumaeq1.4.0
pumaeq2.13.2
pumaeq3.0.1
pumaeq3.6.1
pumaeq4.2.0
pumaeq4.3.1
pumaeq1.6.1
pumaeq1.2.2
pumaeq2.10.0

Name	Operator	Version
puma	eq	3.11.1
puma	eq	1.4.0
puma	eq	2.13.2
puma	eq	3.0.1
puma	eq	3.6.1
puma	eq	4.2.0
puma	eq	4.3.1
puma	eq	1.6.1
puma	eq	1.2.2
puma	eq	2.10.0

Rows per page:

1-10 of 1161

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html

lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html

github.com/puma/puma

github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22

github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd

github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h

github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-11076.yml

lists.debian.org/debian-lts-announce/2020/10/msg00009.html

lists.fedoraproject.org/archives/list/[email protected]/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR

nvd.nist.gov/vuln/detail/CVE-2020-11076

0.005 Low

EPSS

Percentile

77.4%

Related for OSV:GHSA-X7JG-6PWG-FX5H