CVE-2020-5249: HTTP Response Splitting (Early Hints) in Puma
First published: Mon Mar 02 2020(Updated: )
### Impact If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting) While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), which fixed this vulnerability but only for regular responses. ### Patches This has been fixed in 4.3.3 and 3.12.4. ### Workarounds Users can not allow untrusted/user input in the Early Hints response header. ### For more information If you have any questions or comments about this advisory: * Open an issue in [puma](https://github.com/puma/puma) * Email us a project maintainer. [Email addresses are listed in our Code of Conduct](https://github.com/puma/puma/blob/master/CODE_OF_CONDUCT.md#enforcement).
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Puma Puma | <=3.12.3 | |
| Puma Puma | >=4.0.0<=4.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
- https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
- https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
- https://nvd.nist.gov/vuln/detail/CVE-2020-5249
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-5249.yml
- https://github.com/advisories/GHSA-33vf-4xgg-9r58 (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
Frequently Asked Questions
What is CVE-2020-5249?
CVE-2020-5249 is a vulnerability in Puma (RubyGem) that allows an attacker to inject malicious content by using a carriage return character in the early-hints header.
What is the impact of CVE-2020-5249?
The impact of CVE-2020-5249 is that an attacker can inject additional headers or an entirely new response body.
Which software versions are affected by CVE-2020-5249?
Puma versions before 4.3.3 and 3.12.4 are affected by CVE-2020-5249.
How can I fix CVE-2020-5249?
To fix CVE-2020-5249, upgrade Puma to version 4.3.3 or 3.12.4 depending on your current version.
What is the severity of CVE-2020-5249?
CVE-2020-5249 has a severity rating of 6.5 (medium).
- collector/github-advisory-latest
- alias/GHSA-33vf-4xgg-9r58
- alias/CVE-2020-5249
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- package-manager/rubygems
- vendor/puma
- canonical/puma puma
- version/puma puma/3.12.3
- version/puma puma/4.0.0
- version/puma puma/4.3.2