rubygem-secure_headers: directive injection when using dynamic overrides with user input

A flaw was found in rubygem-secureheaders in versions prior to 6.2.0, 5.1.0, and 3.8.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection which could be used to override a script-src directive. The...

UBUNTU-CVE-2020-5216

In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...