CVE-2020-5247

🗓️ 28 Feb 2020 16:55:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 298 Views

Puma (RubyGem) before 4.3.2 and before 3.12.3 allows HTTP Response Splittin

Reporter	Title	Published	Views	Family All 94
CBLMariner	CVE-2020-5247 affecting package ruby 2.6.3-3	9 Jun 202103:50	–	cbl_mariner
Cvelist	CVE-2020-5247 HTTP Response Splitting in Puma	28 Feb 202016:55	–	cvelist
Debian	[SECURITY] [DLA 3023-1] puma security update	25 May 202222:50	–	debian
Debian CVE	CVE-2020-5247	28 Feb 202016:55	–	debiancve
Tenable Nessus	Debian DLA-3023-1 : puma - LTS security update	26 May 202200:00	–	nessus
Tenable Nessus	Fedora 30 : rubygem-puma (2020-08092b4c97)	10 Apr 202000:00	–	nessus
Tenable Nessus	Fedora 31 : rubygem-puma (2020-fd87f90634)	10 Apr 202000:00	–	nessus
Tenable Nessus	openSUSE Security Update : rmt-server (openSUSE-2020-1993)	23 Nov 202000:00	–	nessus
Tenable Nessus	openSUSE Security Update : rmt-server (openSUSE-2020-2000)	24 Nov 202000:00	–	nessus
Tenable Nessus	Photon OS 3.0: Ruby PHSA-2020-3.0-0047	18 Jan 202000:00	–	nessus

NVD

Vulners

Node

puma pumaRange≤3.12.3ruby

puma pumaRange4.0.0–4.3.2ruby

ruby-lang rubyRange≤2.3.0

ruby-lang rubyRange2.4.0–2.4.7

ruby-lang rubyRange2.5.0–2.5.6

ruby-lang rubyRange2.6.0–2.6.4

ruby-lang rubyMatch2.7.0preview1

Node

debian debian_linuxMatch9.0

Node

fedoraproject fedoraMatch30

fedoraproject fedoraMatch31

fedoraproject fedoraMatch32

[
  {
    "product": "Puma",
    "vendor": "puma",
    "versions": [
      {
        "status": "affected",
        "version": "< 3.12.3"
      },
      {
        "status": "affected",
        "version": ">= 4.0.0, < 4.3.2"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
owasp	www.owasp.org/www-community/attacks/HTTP_Response_Splitting
ruby-lang	www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254
github	www.github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
lists	www.lists.debian.org/debian-lts-announce/2022/05/msg00034.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/

21 Nov 2024 05:33Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

CVSS 3.16.5 - 7.5

EPSS0.02094