CVE-2013-1812: XEE
A denial of service flaw was found in the way ruby-openid, a library for verifying and serving OpenID identities, performed processing of certain XML files. An OpenID provider could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).
References: [1] https://github.com/openid/ruby-openid/pull/43 [2] https://bugzilla.novell.com/showbug.cgi?id=804717 [3] http://www.openwall.com/lists/oss-security/2013/03/01/5 [4] http://www.openwall.com/lists/oss-security/2013/03/03/8
Relevant upstream patch: [5] https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed
Other sources
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1812?
CVE-2013-1812 is classified as a denial of service vulnerability due to excessive CPU consumption.
How do I fix CVE-2013-1812?
To fix CVE-2013-1812, upgrade ruby-openid to version 2.2.2 or later.
What systems are affected by CVE-2013-1812?
CVE-2013-1812 affects ruby-openid versions up to and including 2.2.1, along with specific Fedora releases 17 and 18.
What impact does CVE-2013-1812 have on my application?
CVE-2013-1812 can lead to a denial of service, causing application downtime due to high CPU usage.
Is there a known exploit for CVE-2013-1812?
Yes, CVE-2013-1812 can be exploited when an OpenID provider sends a specially-crafted XML file.