Skip to content
OpenAdvisories
Critical USN-9085-1 1 CVE

ruby-openid vulnerability

Published Nov 12, 2026 · Updated Nov 13, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby OpenID sent a request to the claimed identifier
URL before verifying the signature of an OpenID response. A remote attacker
could possibly use this issue to perform server-side request forgery
attacks.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-openid 2.7.0debian-1ubuntu0.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-openid 2.7.0debian-1ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-11027

    ruby-openid SSRF via claimed_id request

    Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to e…

    ruby-openid ruby-openid ruby-openid Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2019-11027