CVE:CVE-2020-11076
CNNVD:CNNVD-202005-1135
Puma是一款针对高并发应用的Web服务器。
Puma (RubyGem) 4.3.4之前版本和3.12.5之前版本中存在环境问题漏洞。攻击者可借助无效的transfer-encoding标头利用该漏洞实施HTTP走私攻击。
solution:Upgrade puma puma to a higher version than 3.12.6,4.3.5,and avoid the version [3.0.0,3.12.6),[4.0.0,4.3.5); Upgrade fedoraproject fedora to a higher version than 33,and avoid the version 33; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0