CVE-2020-5249

{"id": "CVE-2020-5249", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}]}, "published": "2020-03-02T16:15:12.330", "references": [{"url": "https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/", "source": "security-advisories@github.com"}, {"url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4."}, {"lang": "es", "value": "En Puma (RubyGem) versiones anteriores a 3.3 y 3.12.4, si una aplicaci\u00f3n que usa Puma permite una entrada no confiable en un encabezado early-hint, un atacante puede usar un car\u00e1cter retorno de carro para finalizar el encabezado e inyectar contenido malicioso, tales como encabezados adicionales o un cuerpo de respuesta completamente nuevo. Esta vulnerabilidad se conoce como Divisi\u00f3n de Respuesta HTTP. Si bien no es un ataque en s\u00ed mismo, la divisi\u00f3n de la respuesta es un vector para varios otros ataques, tales como un cross-site scripting (XSS). Esto est\u00e1 relacionado con CVE-2020-5247, que corrigi\u00f3 esta vulnerabilidad pero solo para respuestas regulares. Esto se ha corregido en las versiones 4.3.3 y 3.12.4."}], "lastModified": "2023-11-07T03:23:43.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "4556E64B-1B65-4A1B-815E-3FFF181459A4", "versionEndIncluding": "3.12.3"}, {"criteria": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "8E03463F-61DD-4FE9-97FE-F9BA7DC394A1", "versionEndIncluding": "4.3.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}