https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 03:03:00 +0000 https://cve.radiocsirt.org/vuln/cve-2020-5217 <p><strong>Affected:</strong> Twitter secure_headers</p> <p>In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.</p> <p><strong>Affected:</strong> Twitter secure_headers</p> <p>In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.</p> https://cve.radiocsirt.org/vuln/cve-2020-5217 https://cve.radiocsirt.org/vuln/ghsa-xq52-rv6w-397c <p><strong>Affected:</strong> RubyGems: secure_headers</p> <p>### Impact</p> <p>If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.</p> <p>This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.</p> <p>The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.</p> <p>&gt; Duplicate script-src directives detected. All but the first instance will be ignored.</p> <p>See https://www.w3.org/TR/CSP3/#parse-serialized-policy</p> <p>&gt; Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.</p> <p>### Patches</p> <p>Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.</p> <p>### Workarounds</p> <p>If you are passing user input into the above methods, you could filter out the input:</p> <p>```ruby override_content_security_policy_directives(:frame_src, [user_input.gsub(&#34;;&#34;, &#34; &#34;)]) ```</p> <p>### References</p> <p>Reported in https://github.com/twitter/secure_headers/issues/418 https://www.w3.org/TR/CSP…</p> <p><strong>Affected:</strong> RubyGems: secure_headers</p> <p>### Impact</p> <p>If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.</p> <p>This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.</p> <p>The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.</p> <p>&gt; Duplicate script-src directives detected. All but the first instance will be ignored.</p> <p>See https://www.w3.org/TR/CSP3/#parse-serialized-policy</p> <p>&gt; Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.</p> <p>### Patches</p> <p>Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.</p> <p>### Workarounds</p> <p>If you are passing user input into the above methods, you could filter out the input:</p> <p>```ruby override_content_security_policy_directives(:frame_src, [user_input.gsub(&#34;;&#34;, &#34; &#34;)]) ```</p> <p>### References</p> <p>Reported in https://github.com/twitter/secure_headers/issues/418 https://www.w3.org/TR/CSP…</p> https://cve.radiocsirt.org/vuln/ghsa-xq52-rv6w-397c