huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-29660: kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-after-free
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-12-04T00:00:00+00:00

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel. A local user could use this flaw to read numerical value from memory after free.

Statement: This flaw is rated as having Low impact (Red Hat Enterprise Linux 7)  because of the need to have CAP_SYS_TTY_CONFIG privileges.

This flaw is rated as having Moderate (Red Hat Enterprise Linux 8) impact because of the need to have CAP_SYS_TTY_CONFIG privileges. Red Hat Enterprise Linux 8 enabled unprivileged user/network namespaces by default which can be used to exercise this vulnerability.

Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9
CVE-2020-29661: kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-12-04T00:00:00+00:00

A locking vulnerability was found in the tty subsystem of the Linux kernel in drivers/tty/tty_jobctrl.c. This flaw allows a local attacker to possibly corrupt memory or escalate privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 54ffccbf053b5b6ca4f6e45094b942fab92a25fc
CVE-2020-35149: mquery: Code injection via merge or clone operation
Component: mquery
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2020-12-11T00:00:00+00:00

A flaw was found in mquery that allows a prototype pollution attack. This flaw allows an attacker to alter the code behavior by modifying the object prototype. A flaw in the lib/utils.js function allows cloning and merging objects without sanitizing their special properties, such as prototype defining "__proto__". The highest threat from this vulnerability is to integrity.

Statement: The affected version of mquery is a dependency of the mongoose library. The exploitation of this vulnerability requires authenticated access, consequently, the CVSSv3 score for RHACM is lower than the score of the flaw.

Affected upstream versions: n/a
Fixed upstream versions: 3.2.3
Upstream repository: https://github.com/aheckmann/mquery
Upstream fix commit: 792e69fd0a7281a0300be5cade5a6d7c1d468ad4
CVE-2020-35448: binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c
Component: binutils
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2020-09-04T00:00:00+00:00

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 8642dafaef21aa6747cec01df1977e9c52eb4679
CVE-2020-35508: kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2020-12-09T10:00:00+00:00

A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers.  A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.

Statement: The incorrect initialization of the process id affects Red Hat Enterprise Linux only.

Affected upstream versions: kernel 5.12
Fixed upstream versions: v5.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948
CVE-2020-35517: QEMU: virtiofsd: potential privileged host device access from guest
Component: QEMU
Severity: Important
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-01-21T00:00:00+00:00

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue does not affect the version of the qemu-kvm package as shipped with the Red Hat Enterprise Linux 5, 6 and 7. Virtio-fs is fairly new and is not built in the Red Hat Enterprise Linux 5, 6 and 7.

This issue affects the version of the qemu-kvm package as shipped with the Red Hat Enterprise Linux 8. Future qemu-kvm package updates for Red Hat Enterprise Linux 8 may address this issue.

Affected upstream versions: qemu 5.2.0
Fixed upstream versions: v5.2.0
Upstream repository: https://github.com/qemu/qemu
Upstream fix commit: ebf101955ce8f8d72fba103b5151115a4335de2c
CVE-2020-35518: 389-ds-base: information disclosure during the binding of a DN
Component: 389-ds-base
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2020-12-07T00:00:00+00:00

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.


Affected upstream versions: 389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19
Fixed upstream versions: 389-ds-base-2.0.2
Upstream repository: https://github.com/389ds/389-ds-base
Upstream fix commit: cc0f69283abc082488824702dae485b8eae938bc
CVE-2020-35523: libtiff: Integer overflow in tif_getimage.c
Component: libtiff
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-12-14T00:00:00+00:00

An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: libtiff 4.2.0
Fixed upstream versions: v4.2.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: c8d613ef497058fe653c467fc84c70a62a4a71b2
CVE-2020-35524: libtiff: Heap-based buffer overflow in TIFF2PDF tool
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-12-14T00:00:00+00:00

A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: libtiff 4.2.0
Upstream repository: https://gitlab.com/rzkn/libtiff
Upstream fix commit: 7be2e452ddcf6d7abca88f41d3761e6edab72b22
CVE-2020-36158: kernel: buffer overflow in mwifiex_cmd_802_11_ad_hoc_start function in drivers/net/wireless/marvell/mwifiex/join.c via a long SSID value
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-12-08T00:00:00+00:00

A flaw was found in the Linux kernel. The marvell wifi driver could allow a local attacker to execute arbitrary code via a long SSID value in mwifiex_cmd_802_11_ad_hoc_start function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue is rated as having Moderate impact because the attacker needs to be local and privileged enough to be able to initiate ad-hoc WIFI network creation.

Affected upstream versions: n/a
Fixed upstream versions: v5.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5c455c5ab332773464d02ba17015acdca198f03d
CVE-2020-36193: Archive_Tar: directory traversal due to inadequate checking of symbolic links
Component: Archive_Tar
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-01-27T00:00:00+00:00

A flaw was found in the Archive_Tar package. Archive_Tar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences (/../) to modify arbitrary files on the system.

Statement: php-pear 7.2 and 7.3 have been marked End of Life at the time this CVE was released. Therefore no patches would be made available for those versions.

Affected upstream versions: n/a
Fixed upstream versions: 1.4.12
Upstream repository: https://github.com/pear/Archive_Tar
Upstream fix commit: cde460582ff389404b5b3ccb59374e9b389de916
CVE-2020-36241: gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory
Component: gnome-autoar
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 3.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
Public date: 2020-11-06T00:00:00+00:00

autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.


Affected upstream versions: n/a
Fixed upstream versions: 0.3.0
Upstream repository: https://gitlab.gnome.org/GNOME/gnome-autoar
Upstream fix commit: adb067e645732fdbe7103516e506d09eb6a54429
CVE-2020-36312: kernel: memory leak upon a kmalloc failure in kvm_io_bus_unregister_dev function in virt/kvm/kvm_main.c
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-09-11T00:00:00+00:00

A flaw was found in the KVM hypervisor of the Linux kernel. A memory leak could occur in kvm_io_bus_unregister_dev() upon a kmalloc failure. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f65886606c2d3b562716de030706dfe1bea4ed5e
CVE-2020-36314: file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736)
Component: file-roller
Severity: Low
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 3.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
Public date: 2021-02-15T00:00:00+00:00

A path traversal vulnerability was found in file-roller due to an incomplete fix for CVE-2020-11736. It may still be possible to extract files outside of the intended directory in case of malicious archives containing symbolic links. The highest threat from this vulnerability is to data integrity and system availability.


Affected upstream versions: n/a
Fixed upstream versions: 3.39.1
Upstream repository: https://gitlab.gnome.org/GNOME/file-roller
Upstream fix commit: e970f4966bf388f6e7c277357c8b186c645683ae
CVE-2020-36322: kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-12-10T00:00:00+00:00

A denial of service flaw was found in fuse_do_getattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system.

Statement: This issue affected Linux kernel versions as shipped with Red Hat Enterprise Linux from 8.3 and prior the versions. RHEL 8.4 and later versions are not affected.

Affected upstream versions: n/a
Fixed upstream versions: v5.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5d069dbe8aaf2a197142558b6fb2978189ba3454
CVE-2020-36385: kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-06-07T00:00:00+00:00

An issue was discovered in the Linux kernels Userspace Connection Manager Access for RDMA.  This could allow a local attacker to crash the system, corrupt memory or escalate privileges.


Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f5449e74802c1112dea984aec8af7a33c4516af1
CVE-2020-36386: kernel: slab out-of-bounds read in hci_extended_inquiry_result_evt() in net/bluetooth/hci_event.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-07-10T00:00:00+00:00

A flaw out of bounds memory access in the Linux kernel bluetooth subsystem was found in the way when some data being read about the bluetooth device with the hci_extended_inquiry_result_evt call. A local user could use this flaw to crash the system or read some data out of memory bounds that can lead to data confidentiality threat.

Statement: This flaw is rated as having a Moderate impact because even the data being read out of memory bounds is written to some cache, it was known before that this data from non-safe source and as result no any sensitive dependencies on this data.

Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 51c19bf3d5cfaa66571e4b88ba2a6f6295311101
CVE-2020-36557: kernel: race condition between the VT_DISALLOCATE ioctl and closing/opening of ttys, causing a use-after-free in con_shutdown().
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-03-21T10:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s Virtual Terminal subsystem in how a user calls the VT_DISALLOCATE ioctl during the closing/opening of ttys. This flaw allows a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ca4463bf8438b403596edd0ec961ca0d4fbe0220
CVE-2020-36558: kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-02-10T10:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel’s Virtual Terminal subsystem was found in how a user calls the VT_RESIZEX ioctl. This flaw allows a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6cd1ed50efd88261298577cd92a14f2768eddeeb
CVE-2020-36567: gin: Unsanitized input in the default logger in github.com/gin-gonic/gin
Component: gin
Severity: Moderate
CWE: CWE-117 (Improper Output Neutralization for Logs)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2022-12-27T00:00:00+00:00

A flaw was found in gin. This issue occurs when the default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path.


Affected upstream versions: <= v1.5.0
Fixed upstream versions: 1.6.0
Upstream repository: https://github.com/gin-gonic/gin
Upstream fix commit: a71af9c144f9579f6dbe945341c1df37aaf09c0d
CVE-2020-36694: kernel: netfilter: use-after-free in the packet processing context
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2023-05-22T06:30:00+00:00

A use-after-free flaw was found in the packet processing context in net/netfilter/x_tables.c in netfilter in the Linux Kernel. This issue occurs when the per-CPU sequence count is mishandled during concurrent iptables rules replacement and can be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.


Affected upstream versions: n/a
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cc00bcaa589914096edef7fb87ca5cee4a166b5c
CVE-2020-36777: kernel: media: dvbdev: Fix memory leak in dvb_media_device_free()
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-27T00:00:00+00:00

A flaw was found in the Linux kernel. A missing memory release in the dvb_media_device_free function in the drivers/media/dvb-core/dvbdev.c file can result in a memory leak.

Statement: The kernel as shipped by Red Hat Enterprise Linux 9 is not affected by this issue because it already contains the fix.

Affected upstream versions: 4.5
Fixed upstream versions: 0, 4.14.233, 4.19.191, 4.9.269, 5.10.36, 5.11.20, 5.12.3, 5.13, 5.4.118
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06854b943e0571ccbd7ad0a529babed1a98ff275
CVE-2020-4030: freerdp: out of bounds read in TrioParse
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 05cd9ea2290d23931f615c1b004d4b2e69074e27
CVE-2020-4033: freerdp: out-of-bounds read in RLEDECOMPRESS
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.


Affected upstream versions: < 2.1.2
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 0a98c450c58ec150e44781c89aa6f8e7e0f571f5
CVE-2020-5208: ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c
Component: ipmitool
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-02-05T00:00:00+00:00

A flaw was found in several functions of the IPMItool, where it failed to check data received from a LAN properly. An attacker could use this flaw to craft payloads, which can lead to a buffer overflow and also cause memory corruption, a denial of service, and remote code execution.

Statement: The ipmitool package distributed with Red Hat Enterprise Linux versions are compiled using gcc's stack-protector feature. The stack canary generated by this feature helps mitigating any remote code execution attacks for this flaw.

Affected upstream versions: unspecified < < 1.8.19
Fixed upstream versions: < 1.8.19
Upstream repository: https://github.com/ipmitool/ipmitool
Upstream fix commit: e824c23316ae50beb7f7488f2055ac65e8b341f2
CVE-2020-5216: rubygem-secure_headers: limited header injection when using dynamic overrides with user input
Component: rubygem-secure_headers
Severity: Moderate
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2020-01-22T00:00:00+00:00

A directive injection vulnerability was found in Secure Headers RubyGem before versions 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into the vulnerable function, a new line could be injected, leading to limited header injection, which could create a new Content Security Policy header in the HTTP response.

Statement: Satellite 6 ships Secure Header rubygem, however, it does not accept any user input in override_content_security_policy_directive or append_content_security_policy_directive. All directives are hard-coded and therefor Satellite 6 is not vulnerable to this CVE. We may update this rubygem in future release.

Affected upstream versions: < 3.9.0, >= 5.0.0, < 5.2.0, >= 6.0.0, < 6.3.0
Fixed upstream versions: v6.3.0
Upstream repository: https://github.com/twitter/secure_headers
Upstream fix commit: 301695706f6a70517c2a90c6ef9b32178440a2d0
CVE-2020-5217: rubygem-secure_headers: directive injection when using dynamic overrides with user input
Component: rubygem-secure_headers
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2020-01-22T00:00:00+00:00

A flaw was found in rubygem-secure_headers in versions prior to 6.2.0, 5.1.0, and 3.8.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection which could be used to override a script-src directive. The highest threat from this vulnerability is to data integrity.

Statement: Satellite 6 ships Secure Header rubygem, however it does not accept any user input in override_content_security_policy_directive or append_content_security_policy_directive. All directives are hard-coded and therefore, Satellite 6 is not vulnerable to this CVE. We may update this rubygem in future release.

Affected upstream versions: < 3.8.0, >= 5.0.0, < 5.1.0, >= 6.0.0, < 6.2.0
Fixed upstream versions: v5.1.0
Upstream repository: https://github.com/twitter/secure_headers
Upstream fix commit: 936a160e3e9659737a9f9eafce13eea36b5c9fa3