CVE-2013-1812

MEDIUM

4.3

CVSS Severity Score

EPSS Score0.0190%

EPSS Percentile21.92th

PublishedDec 12, 2013

Last ModifiedApr 29, 2026

Vulnerability Description

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

Affected Platforms (CPE)

💻

Fedoraproject

Fedora

= 17

💻

Fedoraproject

Fedora

= 18

📦

Janrain

Ruby Openid

<= 2.2.1

📦

Janrain

Ruby Openid

= 2.2.0

References & Advisories

🔗 http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html

🔗 http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html

🔗 http://www.openwall.com/lists/oss-security/2013/03/03/8

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=918134

🔗 https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md

🔗 https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed

🔗 https://github.com/openid/ruby-openid/pull/43

🔗 http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html

Vulnerability Description

Affected Platforms (CPE)

Fedora

Fedora

Ruby Openid

Ruby Openid

References & Advisories

Related Vulnerabilities