{"id":"CVE-2020-11076","published":"2020-05-22T14:50:12Z","modified":"2024-08-04T11:21:14Z","title":"HTTP Smuggling via Transfer-Encoding Header in Puma","vendor":"puma","product":"puma","tier":"tail","description":{"text":"In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04088,"percentile":0.9071,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22","tags":["x_refsource_MISC"]},{"url":"https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd","tags":["x_refsource_MISC"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00009.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":28.4,"factors":[{"name":"EPSS percentile","points":18.14},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-05-21","earliestUrl":"https://github.com/dentarg/cougar","repos":[{"name":"dentarg/cougar","url":"https://github.com/dentarg/cougar","stars":0,"created":"2020-05-21"}]},"first":{"date":"2020-05-21","source":"PoC-in-GitHub","url":"https://github.com/dentarg/cougar"},"provenance":"source"},"vendorSlug":"puma","affectedVersions":[{"vendor":"puma","product":"puma","versions":["< 3.12.5",">= 4.0.0, < 4.3.4"]}],"affected":[{"ecosystem":"RubyGems","package":"puma","vulnerableRanges":["<3.12.5",">=4.0.0, <4.3.4"],"patched":["3.12.5","4.3.4"],"from":["GHSA-x7jg-6pwg-fx5h"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0447","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-puma-cve-2020-5247","children":[{"from":"CVE-2020-11076","to":"CVE-2022-24790","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/puma/client.rb"],"commits":["https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd","https://github.com/puma/puma/commit/5bb7d202e24dec00a898dca4aa11db391d7787a5"],"basis":"shared function","functions":["setup_body"]}]},{"from":"CVE-2020-11076","to":"CVE-2023-40175","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/puma/client.rb"],"commits":["https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd","https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a","https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662"],"basis":"shared function","functions":["setup_body"]}]}],"packageHistory":[{"cve":"CVE-2019-16770","published":"2019-12-05","fixed":"4.3.1","kev":false},{"cve":"CVE-2020-5247","published":"2020-02-28","fixed":"4.3.3","kev":false},{"cve":"CVE-2020-5249","published":"2020-03-02","fixed":"4.3.3","kev":false,"link":{"from":"CVE-2020-5249","to":"CVE-2020-11076","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"4.3.3","toFixed":"4.3.4","daysApart":81},{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"3.12.4","toFixed":"3.12.5","daysApart":81}]}},{"cve":"CVE-2020-11076","published":"2020-05-22","fixed":"4.3.4","kev":false},{"cve":"CVE-2020-11077","published":"2020-05-22","fixed":"4.3.5","kev":false,"link":{"from":"CVE-2020-11076","to":"CVE-2020-11077","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"4.3.4","toFixed":"4.3.5","daysApart":0},{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"3.12.5","toFixed":"3.12.6","daysApart":0},{"kind":"similar","provenance":"machine","score":0.29,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2021-29509","published":"2021-05-11","fixed":"5.3.1","kev":false},{"cve":"CVE-2021-41136","published":"2021-10-12","fixed":"5.5.1","kev":false}],"package":"RubyGems:puma"}}