A denial of service flaw was found in the way ruby-openid, a library for verifying and serving OpenID identities, performed processing of certain XML files. An OpenID provider could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).

References: [1] https://github.com/openid/ruby-openid/pull/43 [2] https://bugzilla.novell.com/showbug.cgi?id=804717 [3] http://www.openwall.com/lists/oss-security/2013/03/01/5 [4] http://www.openwall.com/lists/oss-security/2013/03/03/8

Relevant upstream patch: [5] https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed