Ubuntu patches SSRF vulnerability CVE-2019-11027 in Ruby OpenID

CVE-2019-11027

Ubuntu has released a fix for SSRF vulnerability CVE-2019-11027 in ruby-openid on Ubuntu bionic and xenial. The flaw could cause a server to connect to arbitrary servers. Prioritize updating to the fixed version in the relevant ESM pocket.

At a glance
Ubuntu has released a fix for SSRF vulnerability CVE-2019-11027 in the ruby-openid package.
Ubuntu bionic and xenial are affected; a server could be made to connect to arbitrary servers.
Prioritize updating to the fixed version in the relevant ESM pocket.

In this article

Ubuntu has released a fix for CVE-2019-11027 in the Ruby OpenID library. The advisory identifies affected versions and updates for Ubuntu bionic and xenial; see the Ubuntu USN-9085-1 security notice.

Overview and technical details

Ruby OpenID is a Ruby library that supports authentication using the OpenID protocol. CVE-2019-11027 concerns how the library handles the claimed identifier URL before verifying the OpenID response signature.

Field	Details
Product	Ruby OpenID (ruby-openid package)
Vulnerability	CVE-2019-11027
Source	Ubuntu USN-9085-1

Affected systems

Product	Affected versions	Fixed version	Pocket
Ubuntu bionic	ruby-openid versions before 2.7.0debian-1ubuntu0.18.04.1~esm1	2.7.0debian-1ubuntu0.18.04.1~esm1	esm-apps
Ubuntu xenial	ruby-openid versions before 2.7.0debian-1ubuntu0.16.04.1~esm1	2.7.0debian-1ubuntu0.16.04.1~esm1	esm-apps-legacy

Mechanism and impact

Ruby OpenID sends a request to the claimed identifier URL before verifying the OpenID response signature. A remote attacker could exploit this sequence to perform SSRF, causing the server to connect to arbitrary servers.

System checks

Check the installed ruby-openid version:
```
dpkg-query -W -f='${Version}\n' ruby-openid
```
Check the candidate version from configured repositories:
```
apt-cache policy ruby-openid
```
Check Ubuntu Pro status to confirm access to the relevant ESM pockets:
```
pro status
```

On Ubuntu bionic, the installed version should be at least 2.7.0debian-1ubuntu0.18.04.1~esm1; on xenial, it should be at least 2.7.0debian-1ubuntu0.16.04.1~esm1.

Remediation and mitigation

Prioritize updating affected Ubuntu bionic and xenial systems using ruby-openid to the corresponding fixed version.
Perform a standard system update to install the necessary updates. The bionic fix is in the esm-apps pocket, while the xenial fix is in the esm-apps-legacy pocket.