{"id":"CVE-2020-5247","details":"In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.","aliases":["BIT-ruby-2020-5247","BIT-ruby-min-2020-5247","GHSA-84j7-475p-hp8v"],"modified":"2026-10-24T10:50:39.873081657Z","published":"2020-02-28T17:15:12.220Z","related":["SUSE-RU-2020:2072-1","SUSE-SU-2020:1066-1","SUSE-SU-2020:1190-1","SUSE-SU-2020:2060-1","SUSE-SU-2020:3036-1","SUSE-SU-2020:3147-1","SUSE-SU-2020:3160-1","openSUSE-SU-2020:1993-1","openSUSE-SU-2020:2000-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING"}],"vendor_product":"debian:debian_linux"},{"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"30"},{"last_affected":"30"},{"introduced":"31"},{"last_affected":"31"},{"introduced":"32"},{"last_affected":"32"}]}],"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/"},{"type":"ADVISORY","url":"https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html"},{"type":"ADVISORY","url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting"},{"type":"ADVISORY","url":"https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/puma/puma","events":[{"introduced":"0"},{"last_affected":"2ff978fa9f27fd3fcd11ddf774d684fda250c46e"},{"introduced":"f5d7600e4e4d9104803b5f0f5f596f8dc45fc191"},{"last_affected":"040a5bf8842fbaebf6656e6556328d6c45be5b10"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"3.12.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:*","range":[{"introduced":"4.0.0"},{"last_affected":"4.3.2"}]}]}}],"versions":["v3.12.3","v4.3.2","v3.12.2","v4.3.1","v3.12.1","v4.3.0","v4.2.1","v4.2.0","v4.1.0","v4.0.1","v4.0.0","v3.12.0","v3.11.4","v3.11.3","v3.11.2","v3.11.1","v3.11.0","v3.10.0","v3.9.1","v3.9.0","v3.8.0","v3.7.1","v3.6.0","v3.5.2","v3.5.1","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.1","v3.1.0","v3.0.2","v3.0.1","v3.0.0","v3.0.0.rc1","v2.16.0","v2.15.3","v2.15.2","v2.15.1","v2.15.0","v2.14.0","v2.13.4","v2.13.3","v2.13.2","v2.13.1","v2.13.0","v2.12.3","v2.12.2","v2.12.1","v2.12.0","v2.11.3","v2.11.2","v2.11.0","v2.10.2","v2.10.1","v2.10.0","v2.9.2","v2.9.1","v2.9.0","v2.8.2","v2.8.1","v2.7.1","v2.7.0","v2.6.0","v2.5.1","v2.5.0","v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.2","v2.2.1","v2.2.0","v2.1.1","v2.1.0","v2.0.1","v2.0.0","v2.0.0.b7","v2.0.0.b6","v2.0.0.b5","v2.0.0.b4","v2.0.0.b3","v2.0.0.b2","v1.5.0","v1.4.0","v1.3.1","v1.3.0","v1.2.2","v1.2.1","v1.2.0","v1.1.1","v1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5247.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/ruby","events":[{"introduced":"0"},{"last_affected":"d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20"},{"introduced":"d4bb726b713658f56e630b6cf817a0155b6f390e"},{"last_affected":"c91478058505cd8cae5160c1056bcde65af5a78b"},{"introduced":"4e0a512972cdcbfcd5279f1a2a81ba342ed75b6e"},{"last_affected":"189a36cfabfc30e785cece0692c802be87ebd9cf"},{"introduced":"c1af7b1e1d408f9796a5f46c9ed36bc5adea4aa2"},{"last_affected":"6315e42c222d5484004494950c7524a85acadb20"},{"introduced":"c55db6aa271df4a689dc8eb0039c929bf6ed43ff"},{"last_affected":"c55db6aa271df4a689dc8eb0039c929bf6ed43ff"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"2.3.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"2.4.0"},{"last_affected":"2.4.7"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","range":[{"introduced":"2.5.0"},{"last_affected":"2.5.6"}]},{"cpe":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","range":[{"introduced":"2.6.0"},{"last_affected":"2.6.4"}],"source":"CPE_RANGE"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:ruby-lang:ruby:2.7.0:preview1:*:*:*:*:*:*","range":[{"introduced":"2.7.0-preview1"},{"last_affected":"2.7.0-preview1"}]}]}}],"versions":["2.7.0-preview1","v2_6_4","v2_5_6","v2_4_7","v2_7_0_preview1","v2_3_0","v1_0_r2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5247.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}