CVE-2020-11076
- Source
- https://cve.org/CVERecord?id=CVE-2020-11076
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11076.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-11076
- Aliases
- Downstream
DEBIAN (1)
OESA (1)
openSUSE (16)
- openSUSE-SU-2020:0990-1
- openSUSE-SU-2020:1001-1
- openSUSE-SU-2020:1993-1
- openSUSE-SU-2020:2000-1
- openSUSE-SU-2024:10589-1
- openSUSE-SU-2024:11342-1
- openSUSE-SU-2024:11343-1
- openSUSE-SU-2024:11830-1
- openSUSE-SU-2024:11847-1
- openSUSE-SU-2024:12592-1
- openSUSE-SU-2024:12900-1
- openSUSE-SU-2024:13166-1
- openSUSE-SU-2024:13720-1
- openSUSE-SU-2024:13721-1
- openSUSE-SU-2025:15123-1
- openSUSE-SU-2026:10357-1
SUSE (7)
UBUNTU (1)
- Related
- Published
- 2020-05-22T15:15:11Z
- Modified
- 2026-10-16T02:33:26Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "9.0" }, { "last_affected": "9.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "33" }, { "last_affected": "33" } ], "source": "CPE_STRING" } ], "vendor_product": "fedoraproject:fedora" } ] }- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKIY5H67GJIGJL6SMFWFLUQQQR3EMVPR/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00038.html
- https://github.com/puma/puma/blob/master/History.md#434435-and-31253126--2020-05-22
- https://github.com/puma/puma/security/advisories/GHSA-x7jg-6pwg-fx5h
- https://lists.debian.org/debian-lts-announce/2020/10/msg00009.html
- https://github.com/puma/puma/commit/f24d5521295a2152c286abb0a45a1e1e2bd275bd
Affected packages
Git / github.com/puma/puma
Affected ranges
- Type
- GIT
- Repo
- https://github.com/puma/puma
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "range": [ { "introduced": "3.0.0" }, { "fixed": "3.12.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*", "range": [ { "introduced": "4.0.0" }, { "fixed": "4.3.5" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "f24d5521295a2152c286abb0a45a1e1e2bd275bd" } ], "source": "REFERENCES_COMMIT" } ] }