CVE-2020-5216

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-5216
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5216.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-5216
Aliases
Related
Published
2020-01-23T03:15:10Z
Modified
2024-10-12T06:36:14.538585Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Secure Headers (RubyGem secureheaders), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

References

Affected packages

Debian:11 / ruby-secure-headers

Package

Name
ruby-secure-headers
Purl
pkg:deb/debian/ruby-secure-headers?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / ruby-secure-headers

Package

Name
ruby-secure-headers
Purl
pkg:deb/debian/ruby-secure-headers?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / ruby-secure-headers

Package

Name
ruby-secure-headers
Purl
pkg:deb/debian/ruby-secure-headers?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/github/secure_headers

Affected ranges

Type
GIT
Repo
https://github.com/github/secure_headers
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
301695706f6a70517c2a90c6ef9b32178440a2d0
Type
GIT
Repo
https://github.com/twitter/secure_headers
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f06956d138f906c8fe32a9a706d36697168e0a55

Affected versions

2.*

2.0.0
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4

v.*

v.2.0.0.pre2

v0.*

v0.4.2
v0.4.3

v1.*

v1.1.1
v1.3.2
v1.3.3
v1.3.4

v2.*

v2.0.0.pre
v2.0.1
v2.0.2
v2.1.0

v3.*

v3.0.0
v3.0.0.rc1
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.5.0
v3.5.0.pre
v3.5.1
v3.6.0
v3.6.1
v3.6.3
v3.6.4
v3.6.5
v3.6.7
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0

v4.*

v4.0.0
v4.0.0.alpha01
v4.0.0.alpha02
v4.0.0.alpha03
v4.0.0.alpha04
v4.0.1

v5.*

v5.0.0.alpha01
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5

v6.*

v6.0.0
v6.0.0.alpha01
v6.0.0.alpha02
v6.0.0.alpha03
v6.1.0
v6.1.1
v6.1.2
v6.2.0