Vulnerability Details : CVE-2020-5247
In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2020-5247
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.7.0:preview1:*:*:*:*:*:*
- cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*
- cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*
Threat overview for CVE-2020-5247
Top countries where our scanners detected CVE-2020-5247
Top open port discovered on systems with this issue
80
IPs affected by CVE-2020-5247 5,132
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2020-5247!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2020-5247
0.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 40 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5247
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |
2.3
|
3.7
|
GitHub, Inc. |
CWE ids for CVE-2020-5247
-
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Assigned by: nvd@nist.gov (Secondary)
-
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.Assigned by: security-advisories@github.com (Primary)
References for CVE-2020-5247
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/
[SECURITY] Fedora 32 Update: rubygem-puma-4.3.3-1.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html
[SECURITY] [DLA 3023-1] puma security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
[SECURITY] Fedora 30 Update: rubygem-puma-3.12.4-1.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://owasp.org/www-community/attacks/HTTP_Response_Splitting
HTTP Response Splitting | OWASPThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/
[SECURITY] Fedora 31 Update: rubygem-puma-3.12.4-1.fc31 - package-announce - Fedora Mailing-ListsMailing List;Patch;Third Party Advisory
-
https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
HTTP Response Splitting · Advisory · puma/puma · GitHubMitigation;Third Party Advisory
-
https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254
CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)Vendor Advisory
Jump to