| Summary | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5. |
|---|---|
| Publication Date | May 23, 2020, 12:15 a.m. |
| Registration Date | Jan. 26, 2021, 11:50 a.m. |
| Last Update | Nov. 21, 2024, 1:56 p.m. |
| CVSS3.1 : HIGH | |
| スコア | 7.5 |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 攻撃元区分(AV) | ネットワーク |
| 攻撃条件の複雑さ(AC) | 低 |
| 攻撃に必要な特権レベル(PR) | 不要 |
| 利用者の関与(UI) | 不要 |
| 影響の想定範囲(S) | 変更なし |
| 機密性への影響(C) | なし |
| 完全性への影響(I) | 高 |
| 可用性への影響(A) | なし |
| CVSS2.0 : MEDIUM | |
| Score | 5.0 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| 攻撃元区分(AV) | ネットワーク |
| 攻撃条件の複雑さ(AC) | 低 |
| 攻撃前の認証要否(Au) | 不要 |
| 機密性への影響(C) | なし |
| 完全性への影響(I) | 低 |
| 可用性への影響(A) | なし |
| Get all privileges. | いいえ |
| Get user privileges | いいえ |
| Get other privileges | いいえ |
| User operation required | いいえ |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* | 4.0.0 | 4.3.5 | |||
| cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* | 3.0.0 | 3.12.6 | |||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | |||||
| Title | Puma における HTTP リクエストスマグリングに関する脆弱性 |
|---|---|
| Summary | Puma (RubyGem) には、HTTP リクエストスマグリングに関する脆弱性が存在します。 |
| Possible impacts | 情報を改ざんされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | May 22, 2020, midnight |
| Registration Date | June 23, 2020, 5:45 p.m. |
| Last Update | June 23, 2020, 5:45 p.m. |
| Puma |
| puma 3.12.6 未満 |
| puma 4.3.5 未満 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2020年06月23日] 掲載 |
June 23, 2020, 5:45 p.m. |