Ruby OpenID vulnerability allows remote Server-Side Request Forgery (SSRF)

A security vulnerability has been identified in the ruby-openid library, which is used for verifying and serving OpenID identities. The flaw allows a remote attacker to potentially perform server-side request forgery (SSRF) attacks against systems utilizing this library.

This issue specifically affects users of Ubuntu 16.04 LTS and 18.04 LTS. Because these versions are in the Extended Security Maintenance (ESM) phase, the necessary patches are provided through Ubuntu Pro via ESM Apps.

Technical details of CVE-2019-11027

• Defect Class: The vulnerability is a Server-Side Request Forgery (SSRF) caused by improper sequencing of operations.
• Attack Vector: A remote attacker can exploit this by providing a malicious OpenID response that triggers a request to a claimed identifier URL.
• Root Cause: The ruby-openid library sends a network request to the identifier URL before it has successfully verified the cryptographic signature of the OpenID response.
• Affected Versions: The vulnerability impacts the ruby-openid package on Ubuntu 16.04 (xenial) and 18.04 (bionic) releases.

Why it matters

Developers using Ruby for identity management must ensure their OpenID implementations are patched to prevent attackers from using their servers to probe internal networks or external services. For system administrators running legacy Ubuntu LTS environments, this update highlights the necessity of Ubuntu Pro/ESM for maintaining security on older production systems.