Stay Secure with the Latest Linux Advisories

security advisorydenial of servicegentoo

Gentoo: GLSA-201405-14 Normal: Ruby OpenID Security Advisory

A vulnerability in Ruby OpenID may lead to Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201405-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Ruby OpenID: Denial of Service Date: May 17, 2014 Bugs: #460156 ID: 201405-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Ruby OpenID may lead to Denial of Service. Background ========= Ruby OpenID is a robust library for verifying and serving OpenID identities. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/ruby-openid < 2.2.2 > = 2.2.2 Description ========== An XML entity parsing error has been discovered in Ruby OpenID. Impact ===== A remote attacker could send a specially crafted XML file, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Ruby OpenID users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-ruby/ruby-openid-2.2.2" References ========= [ 1 ] CVE-2013-1812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1812 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201405-14 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressedto This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Vulnerability in Ruby OpenID poses Denial of Service threat for Gentoo users, necessitating an update to safeguard against potential exploits.. Ruby OpenID, Gentoo Advisory, Denial of Service, Security Update. . LinuxSecurity.com Team

May 17, 2014 Gentoo