Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for secure_headers by Twitter
CVE-2020-5216 (GCVE-0-2020-5216)
Vulnerability from cvelistv5 – Published: 2020-01-23 02:30 – Updated: 2024-08-04 08:22
VLAI
Title
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Severity
4.4 (Medium)
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/twitter/secure_headers/securit… | x_refsource_CONFIRM |
| https://github.com/twitter/secure_headers/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| secure_headers |
Affected:
< 3.9.0
Affected: >= 5.0.0, < 5.2.0 Affected: >= 6.0.0, < 6.3.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:08.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "secure_headers",
"vendor": "Twitter",
"versions": [
{
"status": "affected",
"version": "\u003c 3.9.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.2.0"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-23T02:30:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
],
"source": {
"advisory": "GHSA-w978-rmpf-qmwg",
"discovery": "UNKNOWN"
},
"title": "Limited header injection when using dynamic overrides with user input in RubyGems secure_headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5216",
"STATE": "PUBLIC",
"TITLE": "Limited header injection when using dynamic overrides with user input in RubyGems secure_headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "secure_headers",
"version": {
"version_data": [
{
"version_value": "\u003c 3.9.0"
},
{
"version_value": "\u003e= 5.0.0, \u003c 5.2.0"
},
{
"version_value": "\u003e= 6.0.0, \u003c 6.3.0"
}
]
}
}
]
},
"vendor_name": "Twitter"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg",
"refsource": "CONFIRM",
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"name": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
]
},
"source": {
"advisory": "GHSA-w978-rmpf-qmwg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5216",
"datePublished": "2020-01-23T02:30:15.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:08.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-5217 (GCVE-0-2020-5217)
Vulnerability from cvelistv5 – Published: 2020-01-23 02:15 – Updated: 2024-08-04 08:22
VLAI
Title
Directive injection when using dynamic overrides with user input in RubyGems secure_headers
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
Severity
4.4 (Medium)
CWE
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/twitter/secure_headers/securit… | x_refsource_CONFIRM |
| https://github.com/twitter/secure_headers/issues/418 | x_refsource_MISC |
| https://github.com/twitter/secure_headers/pull/421 | x_refsource_MISC |
| https://github.com/twitter/secure_headers/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| secure_headers |
Affected:
< 3.8.0
Affected: >= 5.0.0, < 5.1.0 Affected: >= 6.0.0, < 6.2.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:08.919Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "secure_headers",
"vendor": "Twitter",
"versions": [
{
"status": "affected",
"version": "\u003c 3.8.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.1.0"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-23T02:15:17.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
],
"source": {
"advisory": "GHSA-xq52-rv6w-397c",
"discovery": "UNKNOWN"
},
"title": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5217",
"STATE": "PUBLIC",
"TITLE": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "secure_headers",
"version": {
"version_data": [
{
"version_value": "\u003c 3.8.0"
},
{
"version_value": "\u003e= 5.0.0, \u003c 5.1.0"
},
{
"version_value": "\u003e= 6.0.0, \u003c 6.2.0"
}
]
}
}
]
},
"vendor_name": "Twitter"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c",
"refsource": "CONFIRM",
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"name": "https://github.com/twitter/secure_headers/issues/418",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"name": "https://github.com/twitter/secure_headers/pull/421",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"name": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
]
},
"source": {
"advisory": "GHSA-xq52-rv6w-397c",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5217",
"datePublished": "2020-01-23T02:15:17.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:08.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-5216 (GCVE-0-2020-5216)
Vulnerability from nvd – Published: 2020-01-23 02:30 – Updated: 2024-08-04 08:22
VLAI
Title
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Severity
4.4 (Medium)
CWE
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/twitter/secure_headers/securit… | x_refsource_CONFIRM |
| https://github.com/twitter/secure_headers/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| secure_headers |
Affected:
< 3.9.0
Affected: >= 5.0.0, < 5.2.0 Affected: >= 6.0.0, < 6.3.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:08.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "secure_headers",
"vendor": "Twitter",
"versions": [
{
"status": "affected",
"version": "\u003c 3.9.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.2.0"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-113",
"description": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-23T02:30:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
],
"source": {
"advisory": "GHSA-w978-rmpf-qmwg",
"discovery": "UNKNOWN"
},
"title": "Limited header injection when using dynamic overrides with user input in RubyGems secure_headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5216",
"STATE": "PUBLIC",
"TITLE": "Limited header injection when using dynamic overrides with user input in RubyGems secure_headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "secure_headers",
"version": {
"version_data": [
{
"version_value": "\u003c 3.9.0"
},
{
"version_value": "\u003e= 5.0.0, \u003c 5.2.0"
},
{
"version_value": "\u003e= 6.0.0, \u003c 6.3.0"
}
]
}
}
]
},
"vendor_name": "Twitter"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Response Splitting\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg",
"refsource": "CONFIRM",
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg"
},
{
"name": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0"
}
]
},
"source": {
"advisory": "GHSA-w978-rmpf-qmwg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5216",
"datePublished": "2020-01-23T02:30:15.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:08.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-5217 (GCVE-0-2020-5217)
Vulnerability from nvd – Published: 2020-01-23 02:15 – Updated: 2024-08-04 08:22
VLAI
Title
Directive injection when using dynamic overrides with user input in RubyGems secure_headers
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
Severity
4.4 (Medium)
CWE
- CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/twitter/secure_headers/securit… | x_refsource_CONFIRM |
| https://github.com/twitter/secure_headers/issues/418 | x_refsource_MISC |
| https://github.com/twitter/secure_headers/pull/421 | x_refsource_MISC |
| https://github.com/twitter/secure_headers/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| secure_headers |
Affected:
< 3.8.0
Affected: >= 5.0.0, < 5.1.0 Affected: >= 6.0.0, < 6.2.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:08.919Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "secure_headers",
"vendor": "Twitter",
"versions": [
{
"status": "affected",
"version": "\u003c 3.8.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.1.0"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-23T02:15:17.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
],
"source": {
"advisory": "GHSA-xq52-rv6w-397c",
"discovery": "UNKNOWN"
},
"title": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5217",
"STATE": "PUBLIC",
"TITLE": "Directive injection when using dynamic overrides with user input in RubyGems secure_headers"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "secure_headers",
"version": {
"version_data": [
{
"version_value": "\u003c 3.8.0"
},
{
"version_value": "\u003e= 5.0.0, \u003c 5.1.0"
},
{
"version_value": "\u003e= 6.0.0, \u003c 6.2.0"
}
]
}
}
]
},
"vendor_name": "Twitter"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c",
"refsource": "CONFIRM",
"url": "https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c"
},
{
"name": "https://github.com/twitter/secure_headers/issues/418",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/issues/418"
},
{
"name": "https://github.com/twitter/secure_headers/pull/421",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/pull/421"
},
{
"name": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3",
"refsource": "MISC",
"url": "https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3"
}
]
},
"source": {
"advisory": "GHSA-xq52-rv6w-397c",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5217",
"datePublished": "2020-01-23T02:15:17.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:08.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}