{"id":"GHSA-fqfj-cmh6-hj49","summary":"ruby-openid SSRF via claimed_id request","details":"Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the \"example app\" provided by the project are at highest risk.","aliases":["CVE-2019-11027"],"modified":"2024-02-16T08:09:34.961861Z","published":"2019-06-13T16:15:56Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2019-06-13T15:45:16Z","nvd_published_at":null,"cwe_ids":["CWE-918"],"severity":"CRITICAL"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11027"},{"type":"WEB","url":"https://github.com/openid/ruby-openid/issues/122"},{"type":"WEB","url":"https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131"},{"type":"PACKAGE","url":"https://github.com/openid/ruby-openid"},{"type":"WEB","url":"https://github.com/openid/ruby-openid/releases/tag/v2.9.0"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html"},{"type":"WEB","url":"https://marc.info/?l=openid-security&m=155154717027534&w=2"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202003-09"}],"affected":[{"package":{"name":"ruby-openid","ecosystem":"RubyGems","purl":"pkg:gem/ruby-openid"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0"}]}],"versions":["1.0","1.0.1","1.0.2","1.1.1","1.1.2","1.1.3","1.1.4","2.0.1","2.0.2","2.0.3","2.0.4","2.1.2","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-fqfj-cmh6-hj49/GHSA-fqfj-cmh6-hj49.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}