CVE-2019-11027: Critical severity openid vulnerability
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11027?
The severity of CVE-2019-11027 can range from medium to critical, depending on the implementation of the ruby-openid library by the web application developer.
How do I fix CVE-2019-11027?
To fix CVE-2019-11027, you should upgrade the ruby-openid library to version 2.9.0 or later, as this version addresses the vulnerability.
What is the impact of CVE-2019-11027?
CVE-2019-11027 allows for remote exploitation, which could lead to unauthorized access or manipulation of a web application's OpenID integrations.
Which versions of ruby-openid are affected by CVE-2019-11027?
Ruby openid versions up to and including 2.8.0 are affected by CVE-2019-11027.
Who is affected by CVE-2019-11027?
Developers using the ruby-openid library in their Rails web applications to integrate with OpenID Providers are affected by CVE-2019-11027.