[DRE-maint] [Bug 1190491] Re: XML denial of service vulnerability

[Jamie Strandboge]

** Changed in: ruby-openid (Ubuntu Quantal)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1190491

Title:
  XML denial of service vulnerability

Status in “libopenid-ruby” package in Ubuntu:
  Invalid
Status in “ruby-openid” package in Ubuntu:
  Fix Released
Status in “libopenid-ruby” source package in Lucid:
  Fix Released
Status in “ruby-openid” source package in Lucid:
  Invalid
Status in “libopenid-ruby” source package in Precise:
  Fix Released
Status in “ruby-openid” source package in Precise:
  Invalid
Status in “libopenid-ruby” source package in Quantal:
  Invalid
Status in “ruby-openid” source package in Quantal:
  Fix Released
Status in “libopenid-ruby” source package in Raring:
  Invalid
Status in “ruby-openid” source package in Raring:
  Fix Released
Status in “libopenid-ruby” source package in Saucy:
  Invalid
Status in “ruby-openid” source package in Saucy:
  Fix Released

Bug description:
  libopenid-ruby is affected by a XML denial of service (Entity
  Expansion Attack / out of memory) attack.

  See: https://github.com/openid/ruby-openid/pull/43

  Patch:
  https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libopenid-ruby/+bug/1190491/+subscriptions