[DRE-maint] [Bug 1190491] Re: XML denial of service vulnerability

[Launchpad Bug Tracker]

This bug was fixed in the package libopenid-ruby - 2.1.8debian-
1ubuntu0.1

---------------
libopenid-ruby (2.1.8debian-1ubuntu0.1) precise-security; urgency=low

  * SECURITY UPDATE: XML denial of service attack (LP: #1190491)
    - debian/patches/02_CVE_2013_1812.patch: lib/openid/fetchers.rb,
      lib/openid/yadis/xrds.rb: limit fetching file size & disable XML entity
      expansion. Based on upstream patch.
    - CVE-2013-1812
 -- Christian Kuersteiner <ckuerste at gmx.ch>   Mon, 24 Jun 2013 10:04:38 +0700

** Changed in: libopenid-ruby (Ubuntu Precise)
       Status: Confirmed => Fix Released

** Changed in: libopenid-ruby (Ubuntu Lucid)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1190491

Title:
  XML denial of service vulnerability

Status in “libopenid-ruby” package in Ubuntu:
  Invalid
Status in “ruby-openid” package in Ubuntu:
  Fix Released
Status in “libopenid-ruby” source package in Lucid:
  Fix Released
Status in “ruby-openid” source package in Lucid:
  Invalid
Status in “libopenid-ruby” source package in Precise:
  Fix Released
Status in “ruby-openid” source package in Precise:
  Invalid
Status in “libopenid-ruby” source package in Quantal:
  Invalid
Status in “ruby-openid” source package in Quantal:
  Confirmed
Status in “libopenid-ruby” source package in Raring:
  Invalid
Status in “ruby-openid” source package in Raring:
  Fix Released
Status in “libopenid-ruby” source package in Saucy:
  Invalid
Status in “ruby-openid” source package in Saucy:
  Fix Released

Bug description:
  libopenid-ruby is affected by a XML denial of service (Entity
  Expansion Attack / out of memory) attack.

  See: https://github.com/openid/ruby-openid/pull/43

  Patch:
  https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libopenid-ruby/+bug/1190491/+subscriptions