openid/ruby-openid

openid/ruby-openid

Releases13

Frequency7 months 1 week

Last Release over 6 years ago

Stars310

OpenID library for Ruby

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-11027 ↗	Jun 10, 2019Monday, 10 June 2019, 19:29	—	10 HIGH
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
CVE-2013-1812 ↗	Dec 12, 2013Thursday, 12 December 2013, 18:55	—	4.3 MEDIUM
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.