Description
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-openid | 2.1.8debian-6 | — |
| Debian 13 | ruby-openid | 2.1.8debian-6 | — |
| Debian 12 | ruby-openid | 2.1.8debian-6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | ruby-openid | < 2.2.2 | 2.2.2 | GHSA-6c8p-qphv-668v |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=918134
- https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md
- FEDORA-2013-20238 vendor-advisory
- https://github.com/openid/ruby-openid/pull/43
- https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed
- FEDORA-2013-20260 vendor-advisory
- [oss-security] 20130302 Re: CVE request: ruby-openid XML denial of service attack mailing-list