USN-9085-1: Ruby OpenID vulnerability

Q: At what point is the claimed identifier URL requested?

Ruby OpenID requests the claimed identifier URL before it verifies the signature on the OpenID response. This means the outbound request can occur before response authenticity has been established.

Published Nov 12, 2026

Updated

It was discovered that Ruby OpenID sent a request to the claimed identifier URL before verifying the signature of an OpenID response. A remote attacker could possibly use this issue to perform server-side request forgery attacks.

Affected Software

4 affected componentsFixes available

All of the following

ubuntu/ruby-openid<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/ruby-openid<2.7.0debian-1ubuntu0.16.04.1~esm1

2.7.0debian-1ubuntu0.16.04.1~esm1

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ruby-openid to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/ruby-openid to a version that resolves this vulnerability.
Fixed in 2.7.0debian-1ubuntu0.16.04.1~esm1

Event History

Nov 12, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-11027

Frequently Asked Questions

At what point is the claimed identifier URL requested?

Ruby OpenID requests the claimed identifier URL before it verifies the signature on the OpenID response. This means the outbound request can occur before response authenticity has been established.