====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN104
_____________________________________________________________________

DATE                : 03/03/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Puma for Ruby versions prior to
                                      4.3.3, 3.12.4.

=====================================================================
https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
_____________________________________________________________________

HTTP Response Splitting (Early Hints)

nateberkopec published GHSA-33vf-4xgg-9r58 Feb 28, 2020


Severity              moderate

Packages              puma (rubygems)

Affected versions     < 4.3.3, < 3.12.3

Patched versions      4.3.3, 3.12.4

CVE identifier        CVE-2020-5249


Impact

If an application using Puma allows untrusted input in an early-hints
header, an attacker can use a carriage return character to end the
header and inject malicious content, such as additional headers or an
entirely new response body. This vulnerability is known as HTTP Response
Splitting

While not an attack in itself, response splitting is a vector for
several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2020-5247, which fixed this vulnerability but
only for regular responses.


Patches

This has been fixed in 4.3.3 and 3.12.4.


Workarounds

Users can not allow untrusted/user input in the Early Hints response
header.

For more information


If you have any questions or comments about this advisory:

    Open an issue in puma
    Email us a project maintainer. Email addresses are listed in our
Code of Conduct.



=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================