Denial of service in ruby-openid (GHSA-6c8p-qphv-668v)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-1812
Severity: MODERATE · CWE: 

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

Affected packages:
package: ecosystem: RubyGems
name: ruby-openid
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.2