{"id":"CVE-2020-5216","published":"2020-01-23T02:30:15Z","modified":"2024-08-04T08:22:08Z","title":"Limited header injection when using dynamic overrides with user input in RubyGems secure_headers","vendor":"Twitter","product":"secure_headers","tier":"tail","description":{"text":"In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01209,"percentile":0.68406,"provenance":"source"},"cwes":[{"id":"CWE-113","name":"Improper Neutralization of CRLF Sequences in HTTP Headers"}],"references":[{"url":"https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0","tags":["x_refsource_MISC"]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":13.68},{"name":"CVSS severity","points":3.08}]},"vendorSlug":"twitter","affectedVersions":[{"vendor":"Twitter","product":"secure_headers","versions":["< 3.9.0",">= 5.0.0, < 5.2.0",">= 6.0.0, < 6.3.0"]}],"affected":[{"ecosystem":"RubyGems","package":"secure_headers","vulnerableRanges":[">=6.0.0, <6.3.0",">=5.0.0, <5.2.0","<3.9.0"],"patched":["6.3.0","5.2.0","3.9.0"],"from":["GHSA-w978-rmpf-qmwg"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0281","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-5217","published":"2020-01-23","fixed":"6.2.0","kev":false,"link":{"from":"CVE-2020-5217","to":"CVE-2020-5216","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:secure_headers","fromFixed":"6.2.0","toFixed":"6.3.0","daysApart":0},{"kind":"version-step","provenance":"source","package":"RubyGems:secure_headers","fromFixed":"5.1.0","toFixed":"5.2.0","daysApart":0},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same product + description similarity"}]}},{"cve":"CVE-2020-5216","published":"2020-01-23","fixed":"6.3.0","kev":false},{"cve":"CVE-2026-54163","published":"2026-07-17","fixed":"7.3.0","kev":false}],"package":"RubyGems:secure_headers"}}