Skip to content
OpenAdvisories
High DSA-4109-1 1 CVE

ruby-omniauth - security update

Published Feb 9, 2018 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 8 ruby-omniauth 1.2.1-1+deb8u1
Debian · 9 ruby-omniauth 1.3.1-1+deb9u1

Vulnerabilities 1

  • High 7.5
    CVE-2017-18076

    Omniauth allows POST parameters to be stored in session

    In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

    omniauth ruby-omniauth ruby-omniauth Debian Ubuntu RubyGems