In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions     before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into     append/override_content_security_policy_directives, a semicolon could be injected leading to directive     injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored     and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all     come before script-src. A previously undefined directive would receive a value even if     SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and     emit a deprecation warning when this happens. This will result in innocuous browser console messages if     being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.
    Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0. (CVE-2020-5217)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions
    before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into
    append/override_content_security_policy_directives, a semicolon could be injected leading to directive
    injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored
    and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all
    come before script-src. A previously undefined directive would receive a value even if
    SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and
    emit a deprecation warning when this happens. This will result in innocuous browser console messages if
    being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.
    Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0. (CVE-2020-5217)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4366 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
    * rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
    * puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
    * jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547     CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
    * foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
    * Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover     (CVE-2020-14380)
    * Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
    * rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
    * rubygem-secure_headers: limited header injection when using dynamic overrides with user input     (CVE-2020-5216)
    * rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
    * rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks     (CVE-2020-5267)
    * puppet: Arbitrary catalog retrieval (CVE-2020-7942)
    * rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
    * rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names     (CVE-2020-8184)
    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)
    * puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL     (CVE-2018-11751)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration     and deployment.

    * Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment

    * Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with     a single job execution.

    * Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet

    * Support for HTTP UEFI provisioning

    * Support for CAC card authentication with Keycloak integration

    * Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.

    * Support for Red Hat Enterprise Linux Traces integration

    * satellite-maintain & foreman-maintain are now self updating

    * Notifications in the UI to warn users when subscriptions are expiring.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257797	Linux Distros Unpatched Vulnerability : CVE-2020-5217	Nessus	Misc.	medium
423559	SCA: security update for secure_headers (GHSA-xq52-rv6w-397c)	Tenable Cloud Security	SCA Checks	medium
423559	SCA: security update for secure_headers (GHSA-xq52-rv6w-397c)	Tenable Self-Hosted Container Security	SCA Checks	medium
142452	RHEL 7 : Satellite 6.8 (Important) (RHSA-2020:4366)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-5217

medium

Tenable Plugins

medium

medium

medium

critical