CVE-2013-1812

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.

El gem de ruby-openid anterior a la versión 2.2.2 para Ruby permite a proveedores de OpenID remotos provocar una denegación de servicio (consumo de CPU) a través de (1) un documento XRDS grande o (2) un ataque de XML Entity Expansion (XEE).

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-12-12 CVE Published
2023-07-25 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-399: Resource Management Errors

CAPEC

References (7)

URL	Tag	Source
https://bugzilla.redhat.com/show_bug.cgi?id=918134	X_refsource_confirm
https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md	X_refsource_confirm
https://github.com/openid/ruby-openid/pull/43	X_refsource_confirm

URL	Date	SRC
https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed	2024-08-06

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2013/03/03/8	2013-12-13

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120204.html	2013-12-13
http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120361.html	2013-12-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				17 Search vendor "Fedoraproject" for product "Fedora" and version "17"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				18 Search vendor "Fedoraproject" for product "Fedora" and version "18"		-		Affected
Janrain Search vendor "Janrain"		Ruby-openid Search vendor "Janrain" for product "Ruby-openid"				<= 2.2.1 Search vendor "Janrain" for product "Ruby-openid" and version " <= 2.2.1"		ruby		Affected
Janrain Search vendor "Janrain"		Ruby-openid Search vendor "Janrain" for product "Ruby-openid"				2.2.0 Search vendor "Janrain" for product "Ruby-openid" and version "2.2.0"		ruby		Affected