Packages
- ruby-openid - Ruby library for verifying and serving OpenID identities
Details
It was discovered that Ruby OpenID sent a request to the claimed identifier
URL before verifying the signature of an OpenID response. A remote attacker
could possibly use this issue to perform server-side request forgery
attacks.
It was discovered that Ruby OpenID sent a request to the claimed identifier
URL before verifying the signature of an OpenID response. A remote attacker
could possibly use this issue to perform server-side request forgery
attacks.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | ruby-openid – 2.7.0debian-1ubuntu0.18.04.1~esm1 | ||
| 16.04 LTS xenial | ruby-openid – 2.7.0debian-1ubuntu0.16.04.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.