Ruby OpenID Vulnerability — Ubuntu Security Update (USN-9085-1)
USN-9085-1 updates Ubuntu 20.04, Ubuntu 22.04: It was discovered that Ruby OpenID sent a request to the claimed identifier URL before verifying the signature of an OpenID response. Apply the update via standard apt tooling.
Что это значит по лицензии SharedLicense
The advisory's own severity data peaks at CVSS 9.8; unpatched Ubuntu 20.04, Ubuntu 22.04 servers remain exposed until updated.
-
USN-9085-1
Publication date
12 November 2026
Overview
Ruby OpenID could be made to connect to arbitrary servers.
Releases
Packages
- ruby-openid – Ruby library for verifying and serving OpenID identities
Details
It was discovered that Ruby OpenID sent a request to the claimed identifier
URL before verifying the signature of an OpenID response. A remote attacker
could possibly use this issue to perform server-side request forgery
attacks.
It was discovered that Ruby OpenID sent a request to the claimed identifier
URL before verifying the signature of an OpenID response. A remote attacker
could possibly use this issue to perform server-side request forgery
attacks.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | ruby-openid – 2.7.0debian-1ubuntu0.18.04.1~esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | ||
| 16.04 LTS xenial | ruby-openid – 2.7.0debian-1ubuntu0.16.04.1~esm1 | ||
References
Часто задаваемые вопросы
What does USN-9085-1 fix?
Which Ubuntu releases are covered?
How do I apply it?
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему