CVE-2020-5216

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

Published Jan 23, 2020 CVSS 3.1 · 4.4 Medium EPSS 1.2% KEV · Not listed
Description
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2020-0281 In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Github GHSA Github GHSA GHSA-w978-rmpf-qmwg Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 4, 2024, 8:22 AM
Reserved
Jan 2, 2020, 12:00 AM
Status
Modified
Published
Jan 23, 2020, 3:15 AM
Modified
Jun 17, 2026, 3:21 AM
Severity
Moderate
Public date
Jan 22, 2020, 12:00 AM