CVE-2020-11076 HTTP Smuggling via Transfer-Encoding Header in Puma
Attackers can smuggle HTTP responses via invalid Transfer-Encoding headers, potentially bypassing security controls or accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11076?
CVE-2020-11076 is a high-severity vulnerability in Debian Debian Linux, published on 22 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
Weakness: CWE-444
Which versions are affected by CVE-2020-11076?
4 open source packages ship an affected version, including puma. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
puma RubyGems | All versions | 3.12.5 |
puma RubyGems | All versions | 3.12.5 |
puma RubyGems | From 4.0.0 | 4.3.4 |
puma RubyGems | From 4.0.0 | 4.3.4 |
Products include Debian Debian Linux, Fedoraproject Fedora, Puma Puma.
How do I fix CVE-2020-11076?
Upgrade puma to a fixed version for your release line: 3.12.5 or 4.3.4.
Is CVE-2020-11076 being exploited?
There is no known exploitation of CVE-2020-11076 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-11076, GHSA-x7jg-6pwg-fx5h, UBUNTU-CVE-2020-11076.