CVE-2019-11027

RubyGems/ruby-openid CVE-2019-11027: critical 9.8

ruby-openid SSRF via claimed_id request

Action: Upgrade ruby-openid to 2.9.0 or later.

bundle update ruby-openid

Affected

Fixed versions

Sources

• osv: GHSA-fqfj-cmh6-hj49
• https://nvd.nist.gov/vuln/detail/CVE-2019-11027
• https://github.com/openid/ruby-openid/issues/122
• https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131
• https://github.com/openid/ruby-openid
• https://github.com/openid/ruby-openid/releases/tag/v2.9.0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml
• https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html
• https://marc.info/?l=openid-security&m=155154717027534&w=2
• https://security.gentoo.org/glsa/202003-09

CVE-2019-11027 · published 2019-06-13T16:15:56Z · modified 2024-02-16T08:09:34.961861Z · JSON