CVE-2020-5247 — HTTP Response Splitting in Puma

Description

In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.

Affected products

Vendor	Product	Affected	Fixed
puma	Puma	< 3.12.3, >= 4.0.0, < 4.3.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	puma	3.12.4-1	—
Debian 13	puma	3.12.4-1	—
Debian 12	puma	3.12.4-1	—
Debian 9	puma	3.6.0-1+deb9u2	DLA-3023-1

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP2	rmt-server	2.6.5-3.3.1	SUSE-SU-2020:3036-1
SLES 15 SP1	rmt-server	2.6.5-3.18.1	SUSE-SU-2020:3160-1
SLES 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1
SLE HPC 15	rmt-server	2.6.5-3.34.1	SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 9	crowbar-core	6.0+git.1587558898.313bb9fd3-3.22.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	crowbar-ha	6.0+git.1586256059.e6f67e1-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	crowbar-openstack	6.0+git.1587753188.da39e44a7-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	memcached	1.5.17-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-ceilometer	11.1.1~dev5-3.13.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-cinder	13.0.10~dev9-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-designate	7.0.1~dev25-3.16.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-heat	11.0.3~dev35-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-ironic	11.1.5~dev3-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-ironic-image	9.0.0-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-manila	7.4.2~dev4-4.21.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-neutron	13.0.8~dev28-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-nova	18.3.1~dev17-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia	3.2.3~dev2-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	openstack-octavia-amphora-image	0.1.3-7.9.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-cinderclient	4.0.3-3.6.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-glanceclient	2.13.2-3.3.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-ironic-lib	2.14.3-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-ironicclient	2.5.4-4.10.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-keystonemiddleware	5.2.2-17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-manila-tempest-plugin	0.1.0-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-novaclient	11.0.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-octaviaclient	1.6.2-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-openstackclient	3.16.3-11.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-os-brick	2.5.10-3.9.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-oslo.config	6.4.2-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-oslo.rootwrap	5.14.2-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-oslo.utils	3.36.5-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-swiftclient	3.6.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	python-watcherclient	2.1.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	release-notes-suse-openstack-cloud	9.20200319-3.18.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	rubygem-crowbar-client	3.9.2-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	rubygem-puma	2.16.0-4.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 9	zookeeper	3.4.13-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud Crowbar 8	crowbar-core	5.0+git.1585575551.16781d00d-3.38.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	crowbar-ha	5.0+git.1585316176.344190f-3.32.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	crowbar-openstack	5.0+git.1585304226.2164b7895-4.37.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	documentation-suse-openstack-cloud-deployment +3	8.20200319-1.23.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	memcached	1.5.17-3.3.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-manila	5.1.1~dev5-3.26.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-manila-doc	5.1.1~dev5-3.26.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-neutron	11.0.9~dev63-3.30.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-neutron-doc	11.0.9~dev63-3.30.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-nova	16.1.9~dev61-3.35.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	openstack-nova-doc	16.1.9~dev61-3.35.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	python-amqp	2.4.2-3.9.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	rubygem-puma	2.16.0-3.6.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud Crowbar 8	zookeeper	3.4.10-3.6.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 9	ardana-ansible	9.0+git.1587034359.a12678b-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-barbican	9.0+git.1583953599.cd723bb-3.10.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-cluster	9.0+git.1585653734.c1fe3b2-3.13.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-db	9.0+git.1586543314.6b6aa20-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-designate	9.0+git.1583445435.4bd1793-3.10.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-input-model	9.0+git.1584632190.9541c56-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-logging	9.0+git.1585929695.f35b591-3.10.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-monasca	9.0+git.1586769889.d43d736-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-mq	9.0+git.1586350749.a463fd2-3.13.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-neutron	9.0+git.1587667603.507fb50-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-octavia	9.0+git.1587486004.8e99c6b-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-osconfig	9.0+git.1586546715.dbd07ab-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-tempest	9.0+git.1587398456.b31cc4a-3.13.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	ardana-tls	9.0+git.1586301209.c9413b4-3.12.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	memcached	1.5.17-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-ceilometer	11.1.1~dev5-3.13.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-cinder	13.0.10~dev9-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-designate	7.0.1~dev25-3.16.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-heat	11.0.3~dev35-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-ironic	11.1.5~dev3-3.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-ironic-image	9.0.0-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-manila	7.4.2~dev4-4.21.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-neutron	13.0.8~dev28-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-nova	18.3.1~dev17-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-octavia	3.2.3~dev2-3.22.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	openstack-octavia-amphora-image	0.1.3-7.9.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-cinderclient	4.0.3-3.6.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-glanceclient	2.13.2-3.3.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-ironic-lib	2.14.3-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-ironicclient	2.5.4-4.10.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-keystonemiddleware	5.2.2-17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-manila-tempest-plugin	0.1.0-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-novaclient	11.0.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-octaviaclient	1.6.2-3.6.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-openstackclient	3.16.3-11.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-os-brick	2.5.10-3.9.2	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-oslo.config	6.4.2-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-oslo.rootwrap	5.14.2-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-oslo.utils	3.36.5-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-swiftclient	3.6.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	python-watcherclient	2.1.1-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	release-notes-suse-openstack-cloud	9.20200319-3.18.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-barbican	7.0.1~dev24-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-cinder	13.0.10~dev9-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-designate	7.0.1~dev25-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-glance	17.0.1~dev30-3.15.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-heat	11.0.3~dev35-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-horizon	14.1.1~dev1-4.16.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-ironic	11.1.5~dev3-4.13.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-keystone	14.1.1~dev36-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-magnum	7.2.1~dev1-4.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-manila	7.4.2~dev4-3.19.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-monasca	2.7.1~dev10-3.15.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-monasca-ceilometer	1.8.2~dev3-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-neutron	13.0.8~dev28-6.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-nova	18.3.1~dev17-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-octavia	3.2.3~dev2-4.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-sahara	9.0.2~dev15-3.17.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	venv-openstack-swift	2.19.2~dev48-2.12.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 9	zookeeper	3.4.13-3.3.1	SUSE-SU-2020:1190-1
SUSE OpenStack Cloud 8	ardana-ansible	8.0+git.1583432621.24fa60e-3.70.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-barbican	8.0+git.1585152761.8ef3d61-4.33.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-db	8.0+git.1583944923.03cca6c-3.31.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-monasca	8.0+git.1583944894.38f023a-3.24.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-mq	8.0+git.1583944811.dc14403-3.19.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-neutron	8.0+git.1584715262.e4ea620-3.39.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-octavia	8.0+git.1585171918.418f5cf-3.26.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	ardana-tempest	8.0+git.1585311051.6ab5488-3.33.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	documentation-suse-openstack-cloud-user +8	8.20200319-1.23.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	memcached	1.5.17-3.3.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-manila	5.1.1~dev5-3.26.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-manila-doc	5.1.1~dev5-3.26.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-neutron	11.0.9~dev63-3.30.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-neutron-doc	11.0.9~dev63-3.30.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-nova	16.1.9~dev61-3.35.2	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	openstack-nova-doc	16.1.9~dev61-3.35.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	pdns	4.1.2-3.6.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	python-amqp	2.4.2-3.9.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-aodh	5.1.1~dev7-12.24.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-barbican	5.0.2~dev3-12.25.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-ceilometer	9.0.8~dev7-12.22.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-cinder	11.2.3~dev23-14.25.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-designate	5.0.3~dev7-12.23.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.20.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-glance	15.0.3~dev3-12.23.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-heat	9.0.8~dev22-12.25.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-ironic	9.1.8~dev8-12.25.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-keystone	12.0.4~dev5-11.26.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.24.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-manila	5.1.1~dev5-12.29.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.20.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-murano	4.0.2~dev2-12.20.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-neutron	11.0.9~dev63-13.28.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-nova	16.1.9~dev61-11.26.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-octavia	1.0.6~dev3-12.25.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-sahara	7.0.5~dev4-11.24.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	venv-openstack-trove	8.0.2~dev2-11.24.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 8	zookeeper	3.4.10-3.6.1	SUSE-SU-2020:1066-1
SUSE OpenStack Cloud 7	ansible	2.2.3.0-12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-core	4.0+git.1580209654.1d112d31f-9.66.5	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-ha	4.0+git.1585316203.d6ad2c8-4.52.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	crowbar-openstack	4.0+git.1589804581.9972163f0-9.71.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	grafana	4.6.5-1.14.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	keepalived	2.0.19-1.8.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	kibana	4.6.3-5.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	memcached	1.5.17-3.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	monasca-installer	20180608_12.47-12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-dashboard-theme-SUSE	2016.2-5.12.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila	3.0.1~dev30-4.12.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-manila-doc	3.0.1~dev30-4.12.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas	9.0.2~dev5-4.9.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-neutron-fwaas-doc	9.0.2~dev5-4.9.4	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-nova +1	14.0.11~dev13-4.40.2	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	openstack-tempest	12.2.1~a0~dev177-4.9.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Django	1.8.19-3.23.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-Pillow	2.8.1-4.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psql2mysql	0.5.0+git.1589351878.4ef877c-1.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-psutil	1.2.1-21.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-py	1.8.1-11.12.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-pysaml2	4.0.2-3.17.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	python-waitress	1.4.3-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rabbitmq-server	3.4.4-3.16.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	release-notes-suse-openstack-cloud	7.20180803-3.18.3	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-activeresource	4.0.0-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-crowbar-client	3.9.2-7.20.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-json-1_7	1.7.7-3.3.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	rubygem-puma	2.16.0-4.6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 7	zookeeper	3.4.10-6.1	SUSE-RU-2020:2072-1
SUSE OpenStack Cloud 6	rubygem-puma	2.16.0-4.3.1	SUSE-SU-2020:2060-1
SUSE HPE Helion OpenStack 8	ardana-ansible	8.0+git.1583432621.24fa60e-3.70.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-barbican	8.0+git.1585152761.8ef3d61-4.33.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-db	8.0+git.1583944923.03cca6c-3.31.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-monasca	8.0+git.1583944894.38f023a-3.24.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-mq	8.0+git.1583944811.dc14403-3.19.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-neutron	8.0+git.1584715262.e4ea620-3.39.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-octavia	8.0+git.1585171918.418f5cf-3.26.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	ardana-tempest	8.0+git.1585311051.6ab5488-3.33.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	documentation-hpe-helion-openstack-user +5	8.20200319-1.23.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	memcached	1.5.17-3.3.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-manila	5.1.1~dev5-3.26.2	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-manila-doc	5.1.1~dev5-3.26.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-neutron	11.0.9~dev63-3.30.2	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-neutron-doc	11.0.9~dev63-3.30.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-nova	16.1.9~dev61-3.35.2	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	openstack-nova-doc	16.1.9~dev61-3.35.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	pdns	4.1.2-3.6.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	python-amqp	2.4.2-3.9.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-aodh	5.1.1~dev7-12.24.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-barbican	5.0.2~dev3-12.25.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-ceilometer	9.0.8~dev7-12.22.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-cinder	11.2.3~dev23-14.25.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-designate	5.0.3~dev7-12.23.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-freezer	5.0.0.0~xrc2~dev2-10.20.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-glance	15.0.3~dev3-12.23.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-heat	9.0.8~dev22-12.25.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-ironic	9.1.8~dev8-12.25.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-keystone	12.0.4~dev5-11.26.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-magnum	5.0.2_5.0.2_5.0.2~dev31-11.24.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-manila	5.1.1~dev5-12.29.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-monasca-ceilometer	1.5.1_1.5.1_1.5.1~dev3-8.20.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-murano	4.0.2~dev2-12.20.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-neutron	11.0.9~dev63-13.28.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-nova	16.1.9~dev61-11.26.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-octavia	1.0.6~dev3-12.25.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-sahara	7.0.5~dev4-11.24.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	venv-openstack-trove	8.0.2~dev2-11.24.1	SUSE-SU-2020:1066-1
SUSE HPE Helion OpenStack 8	zookeeper	3.4.10-3.6.1	SUSE-SU-2020:1066-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.2	rmt-server	2.6.5-lp152.2.3.1	openSUSE-SU-2020:1993-1
openSUSE Leap 15.1	rmt-server	2.6.5-lp151.2.18.2	openSUSE-SU-2020:2000-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	puma	< 3.12.4	3.12.4	GHSA-84j7-475p-hp8v
RubyGems	puma	>= 4.0.0, < 4.3.3	4.3.3	GHSA-84j7-475p-hp8v

Advisories 10

DLA-3023-1 puma - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:2060-1 Security update for rubygem-puma SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1190-1 Security update for ardana-ansible, ardana-barbican, ardana-cluster, ardana-db, ardana-designate, ardana-input-model, ardana-logging, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, memcached, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-ironic, openstack-ironic-image, openstack-manila, openstack-neutron, openstack-nova, openstack-octavia, openstack-octav SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3160-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:1993-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3036-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:3147-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:2000-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1066-1 Security update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026

References

https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
https://owasp.org/www-community/attacks/HTTP_Response_Splitting
https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254
FEDORA-2020-a3f26a9387 vendor-advisory
FEDORA-2020-fd87f90634 vendor-advisory
FEDORA-2020-08092b4c97 vendor-advisory
[debian-lts-announce] 20220525 [SECURITY] [DLA 3023-1] puma security update mailing-list

CNA	v3.1	6.5
EUVD	v3.1	6.5
OSV:GHSA	v3.1	6.5