CVE-2019-11027

🗓️ 10 Jun 2019 19:29:00Reported by [email protected]Type

Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk

Reporter	Title	Published	Views	Family All 22
CNVD	Unspecified Vulnerability in Ruby OpenID	10 Jun 201900:00	–	cnvd
CVE	CVE-2019-11027	10 Jun 201918:57	–	cve
Cvelist	CVE-2019-11027	10 Jun 201918:57	–	cvelist
Debian	[SECURITY] [DLA 1956-1] ruby-openid security update	11 Oct 201905:15	–	debian
Debian CVE	CVE-2019-11027	10 Jun 201918:57	–	debiancve
Tenable Nessus	Debian DLA-1956-1 : ruby-openid security update	11 Oct 201900:00	–	nessus
Tenable Nessus	GLSA-202003-09 : OpenID library for Ruby: Server-Side Request Forgery	16 Mar 202000:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2019-11027	30 Aug 202500:00	–	nessus
EUVD	EUVD-2019-0532	7 Oct 202500:30	–	euvd
Github Security Blog	ruby-openid SSRF via claimed_id request	13 Jun 201916:15	–	github

NVD

Node

openid ruby-openidRange≤2.8.0

Source	Link
marc	www.marc.info/
lists	www.lists.debian.org/debian-lts-announce/2019/10/msg00014.html
github	www.github.com/openid/ruby-openid/issues/122
security	www.security.gentoo.org/glsa/202003-09

21 Nov 2024 04:20Current

9.4High risk

Vulners AI Score9.4

CVSS 39.8

CVSS 210

EPSS0.01731