CVE:CVE-2020-5247
CNNVD:CNNVD-202002-1298
Puma是一款针对高并发应用的Web服务器。
Puma (RubyGem) 4.3.2之前版本和3.12.2之前版本中存在注入漏洞。攻击者可通过使用换行符（例如CR，LF，/ r或 / n）利用该漏洞结束标头并注入恶意内容。
solution:Upgrade puma puma to a higher version than 3.12.3,4.3.2,and avoid the version (,3.12.3],[4.0.0,4.3.2]; Upgrade ruby-lang ruby to a higher version than 2.3.0,2.4.7,2.5.6,2.6.4,2.7.0:preview1,and avoid the version (,2.3.0],[2.4.0,2.4.7],[2.5.0,2.5.6],[2.6.0,2.6.4],2.7.0:preview1; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade fedoraproject fedora to a higher version than 30,31,32,and avoid the version 30,31,32