Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| secure_headers | before 3.9.0; 5.0.0 to before 5.2.0; 6.0.0 to before 6.3.0 | 3.9.0, 5.2.0, 6.3.0 | Patch available | CNA | |
| — | secure_headers (RubyGems) | 6.0.0 to before 6.3.0 | 6.3.0 | Patch available | GHSA-w978-rmpf-qmwg |
| — | secure_headers (RubyGems) | 5.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-w978-rmpf-qmwg |
| — | secure_headers (RubyGems) | before 3.9.0 | 3.9.0 | Patch available | GHSA-w978-rmpf-qmwg |
- secure_headers VendorTwitter Affected before 3.9.0; 5.0.0 to before 5.2.0; 6.0.0 to before 6.3.0 Fixed in 3.9.0, 5.2.0, 6.3.0 Patch available CNA
- secure_headers (RubyGems) Vendor— Affected 6.0.0 to before 6.3.0 Fixed in 6.3.0 Patch available GHSA-w978-rmpf-qmwg
- secure_headers (RubyGems) Vendor— Affected 5.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-w978-rmpf-qmwg
- secure_headers (RubyGems) Vendor— Affected before 3.9.0 Fixed in 3.9.0 Patch available GHSA-w978-rmpf-qmwg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:* | before 3.9.0; 5.0.0 to before 5.2.0; 6.0.0 to before 6.3.0 | Vulnerable |
- cpe:2.3:a:twitter:secure_headers:*:*:*:*:*:ruby:*:* Versions before 3.9.0; 5.0.0 to before 5.2.0; 6.0.0 to before 6.3.0 Vulnerable ·Twitter
Remediation
- Fix · CNA secure_headers (Twitter) Fixed in 3.9.0, 5.2.0, 6.3.0
- Fix · GHSA-w978-rmpf-qmwg secure_headers (RubyGems) Fixed in 6.3.0 Advisory →
- Fix · GHSA-w978-rmpf-qmwg secure_headers (RubyGems) Fixed in 5.2.0 Advisory →
- Fix · GHSA-w978-rmpf-qmwg secure_headers (RubyGems) Fixed in 3.9.0 Advisory →
Red Hat 1 advisory
- RHSA-2020:4366 Released 2020-10-27 · Red Hat rating ImportantSatellite 6.8 release
- Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
- Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6.8 | Fixed | RHSA-2020:4366 |
| Red Hat Satellite Capsule 6.8 | Fixed | RHSA-2020:4366 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5216
- 2026-10-03 Alias added: GHSA-w978-rmpf-qmwg
References
More Twitter Secure Headers vulnerabilities
- TI-2020-04273 Directive injection when using dynamic overrides with user input in RubyGems secure_headers CVSS 3.1MEDIUM 5.8
Sources
- CVE-2020-5216 · CVE Program
- CVE-2020-5216 · NVD
- FIRST EPSS
- GHSA-w978-rmpf-qmwg · GitHub Advisory Database · CC BY 4.0
- CVE-2020-5216 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences