REDHAT-BUG-1801286: Medium severity Twitter secure_headers vulnerability
In Secure Headers (RubyGem secureheaders), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.
Reference: https://github.com/twitter/secureheaders/security/advisories/GHSA-w978-rmpf-qmwg
Upstream commit: https://github.com/twitter/secureheaders/commit/301695706f6a70517c2a90c6ef9b32178440a2d0
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1801286?
The severity of REDHAT-BUG-1801286 is considered high due to the potential for header injection.
How do I fix REDHAT-BUG-1801286?
To fix REDHAT-BUG-1801286, upgrade to secure_headers version 3.9.0, 5.2.0, or 6.3.0 or later.
What is the impact of REDHAT-BUG-1801286?
The impact of REDHAT-BUG-1801286 includes the possibility of unauthorized header modifications leading to security vulnerabilities.
Which versions are affected by REDHAT-BUG-1801286?
Versions of secure_headers prior to 3.9.0, 5.2.0, and 6.3.0 are affected by REDHAT-BUG-1801286.
Is REDHAT-BUG-1801286 a zero-day vulnerability?
REDHAT-BUG-1801286 is not classified as a zero-day vulnerability since the affected versions have available updates.