SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

CVE

CVE-2013-1812

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 4.3
Exploit Score: 8.6
Impact Score: 2.9

CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: NONE
Integrity: NONE
Availability: PARTIAL

Reference:

FEDORA-2013-20238

FEDORA-2013-20260

http://www.openwall.com/lists/oss-security/2013/03/03/8

https://bugzilla.redhat.com/show_bug.cgi?id=918134

https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md

https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed

https://github.com/openid/ruby-openid/pull/43


30479



423868



250770



909



196157



282