Candidate: CVE-2020-5217
PublicDate: 2020-01-23 03:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5217
 https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
 https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3
 https://github.com/twitter/secure_headers/issues/418
 https://github.com/twitter/secure_headers/pull/421
Description:
 In Secure Headers (RubyGem secure_headers), a directive injection
 vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If
 user-supplied input was passed into
 append/override_content_security_policy_directives, a semicolon could be
 injected leading to directive injection. This could be used to e.g.
 override a script-src directive. Duplicate directives are ignored and the
 first one wins. The directives in secure_headers are sorted alphabetically
 so they pretty much all come before script-src. A previously undefined
 directive would receive a value even if SecureHeaders::OPT_OUT was
 supplied. The fixed versions will silently convert the semicolons to spaces
 and emit a deprecation warning when this happens. This will result in
 innocuous browser console messages if being exploited/accidentally used. In
 future releases, we will raise application errors resulting in 500s.
 Depending on what major version you are using, the fixed versions are
 6.2.0, 5.1.0, 3.8.0.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949999
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N [5.8 MEDIUM]


Patches_ruby-secure-headers:
upstream_ruby-secure-headers: needs-triage
precise/esm_ruby-secure-headers: DNE
trusty_ruby-secure-headers: ignored (out of standard support)
trusty/esm_ruby-secure-headers: DNE
xenial_ruby-secure-headers: DNE
bionic_ruby-secure-headers: needs-triage
eoan_ruby-secure-headers: ignored (reached end-of-life)
focal_ruby-secure-headers: needs-triage
groovy_ruby-secure-headers: not-affected (6.3.1-1)
hirsute_ruby-secure-headers: not-affected (6.3.1-1)
impish_ruby-secure-headers: not-affected (6.3.1-1)
jammy_ruby-secure-headers: not-affected (6.3.1-1)
devel_ruby-secure-headers: not-affected (6.3.1-1)