The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU
    consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack. (CVE-2013-1812)

The remote host is affected by the vulnerability described in GLSA-201405-14 (Ruby OpenID: Denial of Service)

    An XML entity parsing error has been discovered in Ruby OpenID.
  Impact :

    A remote attacker could send a specially crafted XML file, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

New package. A Ruby library for verifying and serving OpenID identities. Ruby OpenID makes it easy to add OpenID authentication to your web applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

(Package is renamed from ruby-openid.) This package is a Ruby library for verifying and serving OpenID identities. Ruby OpenID makes it easy to add OpenID authentication to your web applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
423246	SCA: security update for ruby-openid (GHSA-6c8p-qphv-668v)	Tenable Cloud Security	SCA Checks	Local	medium
423246	SCA: security update for ruby-openid (GHSA-6c8p-qphv-668v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
74057	GLSA-201405-14 : Ruby OpenID: Denial of Service	Nessus	Gentoo Local Security Checks	Local	medium
70811	Fedora 20 : rubygem-ruby-openid-2.3.0-3.fc20 (2013-20238)	Nessus	Fedora Local Security Checks	Local	medium
70786	Fedora 19 : rubygem-ruby-openid-2.3.0-3.fc19 (2013-20260)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-1812

medium

Tenable Plugins

medium

medium

medium

medium

medium