CoreCVE
Back

MEDIUM

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

Published Jan 23, 2020

Description

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

Affected products

Remediation

Red Hat statement

Satellite 6 ships Secure Header rubygem, however, it does not accept any user input in override_content_security_policy_directive or append_content_security_policy_directive. All directives are hard-coded and therefor Satellite 6 is not vulnerable to this CVE. We may update this rubygem in future release.

Weaknesses (3)

CWE-113

CWE-74

CWE-93

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jan 23, 2020
Updated Aug 4, 2024
Reserved Jan 2, 2020
Link CVE-2020-5216
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-5216
Red Hat
Severity Moderate
Public date Jan 22, 2020
Links CVE-2020-5216 - Bugzilla
ENISA EUVD
Assigner GitHub_M
Published Jan 23, 2020
Updated Aug 4, 2024
Exploited since n/a
Link EUVD-2020-0281
EUVD-2020-0281 GHSA-W978-RMPF-QMWG