CVE-2020-5216
1 advisory.
RubyGems/secure_headers CVE-2020-5216: medium 4.4
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Action: Upgrade secure_headers to 3.9.0 or later.
bundle update secure_headersAffected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.3.0 | - |
| 5.0.0 | 5.2.0 | - |
| 0 | 3.9.0 | - |
Fixed versions
| 6.3.0 | 5.2.0 | 3.9.0 |
Sources
- osv: GHSA-w978-rmpf-qmwg
- https://github.com/twitter/secure_headers/security/advisories/GHSA-w978-rmpf-qmwg
- https://nvd.nist.gov/vuln/detail/CVE-2020-5216
- https://github.com/twitter/secure_headers/commit/301695706f6a70517c2a90c6ef9b32178440a2d0
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/secure_headers/CVE-2020-5216.yml
- https://github.com/twitter/secure_headers
CVE-2020-5216 · published · modified · JSON