[DRE-maint] Bug#949999: ruby-secure-headers: CVE-2020-5217

[Salvatore Bonaccorso]

Source: ruby-secure-headers
Version: 6.1.1-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for ruby-secure-headers.

CVE-2020-5217[0]:
| In Secure Headers (RubyGem secure_headers), a directive injection
| vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0.
| If user-supplied input was passed into
| append/override_content_security_policy_directives, a semicolon could
| be injected leading to directive injection. This could be used to e.g.
| override a script-src directive. Duplicate directives are ignored and
| the first one wins. The directives in secure_headers are sorted
| alphabetically so they pretty much all come before script-src. A
| previously undefined directive would receive a value even if
| SecureHeaders::OPT_OUT was supplied. The fixed versions will silently
| convert the semicolons to spaces and emit a deprecation warning when
| this happens. This will result in innocuous browser console messages
| if being exploited/accidentally used. In future releases, we will
| raise application errors resulting in 500s. Depending on what major
| version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-5217
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5217

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-6-amd64 (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)