Ubuntu
ruby-openid package

  1. Bug #1190179
  2. Comment #5

Comment 5 for bug 1190179

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ruby-openid - 2.1.8debian-5ubuntu0.1

---------------
ruby-openid (2.1.8debian-5ubuntu0.1) quantal-security; urgency=low

  * SECURITY UPDATE: XML denial of service attack (LP: #1190179)
    - debian/patches/02_CVE_2013_1812.patch: lib/openid/fetchers.rb,
      lib/openid/yadis/xrds.rb: limit fetching file size & disable XML entity
      expansion. Based on upstream patch.
    - CVE-2013-1812
 -- Christian Kuersteiner <email address hidden> Wed, 12 Jun 2013 16:37:06 +0700