Bug 1801264 (CVE-2020-5217) - CVE-2020-5217 rubygem-secure_headers: directive injection when using dynamic overrides with user input
Summary: CVE-2020-5217 rubygem-secure_headers: directive injection when using dynamic ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-5217
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1802503 1802504 1866306
Blocks: 1801265
TreeView+ depends on / blocked
 
Reported: 2020-02-10 14:29 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-12-14 18:47 UTC (History)
21 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in rubygem-secure_headers in versions prior to 6.2.0, 5.1.0, and 3.8.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection which could be used to override a script-src directive. The highest threat from this vulnerability is to data integrity.
Clone Of:
Environment:
Last Closed: 2020-10-27 14:21:20 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4366 0 None None None 2020-10-27 12:55:42 UTC

Description Guilherme de Almeida Suckevicz 2020-02-10 14:29:23 UTC
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

References:
https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
https://github.com/twitter/secure_headers/issues/418

Upstream commit:
https://github.com/twitter/secure_headers/commit/936a160e3e9659737a9f9eafce13eea36b5c9fa3

Comment 2 Yadnyawalk Tale 2020-02-13 10:01:36 UTC
External References:

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c

Comment 8 Eric Christensen 2020-08-24 16:21:00 UTC
Statement:

Satellite 6 ships Secure Header rubygem, however it does not accept any user input in override_content_security_policy_directive or append_content_security_policy_directive. All directives are hard-coded and therefore, Satellite 6 is not vulnerable to this CVE. We may update this rubygem in future release.

Comment 9 errata-xmlrpc 2020-10-27 12:55:55 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.7 for RHEL 8

Via RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366

Comment 10 Product Security DevOps Team 2020-10-27 14:21:20 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-5217


Note You need to log in before you can comment on or make changes to this bug.