~ / search / GHSA-x7jg-6pwg-fx5h

GHSA-x7jg-6pwg-fx5h

HTTP Smuggling via Transfer-Encoding Header in Puma

Source: GitHub Advisory Database (reviewed) High CVE-2020-11076

Packages

EcosystemPackageAffectedFixed in
RubyGems puma < 3.12.5 3.12.5
RubyGems puma >= 4.0.0, < 4.3.4 4.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling) Originally reported by @ZeddYu, who has our thanks for the detailed report. ### Patches The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Puma](https://github.com/puma/puma) * See our [security policy](https://github.com/puma/puma/security/policy)

References

External links from the advisory. They lead to third-party sites.