{"action":"Upgrade ruby-openid to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0"}],"component":"ruby-openid","cve_ids":["CVE-2019-11027"],"ecosystem":"RubyGems","epss":0.02968,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-fqfj-cmh6-hj49","id":"tcs_01M5KEK4BPKKZXGA80VP5B96ND","modified_at":"2024-02-16T08:09:34.961861Z","published_at":"2019-06-13T16:15:56Z","references":["https://osv.dev/vulnerability/GHSA-fqfj-cmh6-hj49","https://nvd.nist.gov/vuln/detail/CVE-2019-11027","https://github.com/openid/ruby-openid/issues/122","https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131","https://github.com/openid/ruby-openid","https://github.com/openid/ruby-openid/releases/tag/v2.9.0","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml","https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html","https://marc.info/?l=openid-security&m=155154717027534&w=2","https://security.gentoo.org/glsa/202003-09"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fqfj-cmh6-hj49","url":"https://osv.dev/vulnerability/GHSA-fqfj-cmh6-hj49"}],"summary":"ruby-openid SSRF via claimed_id request"}