WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongo | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygems-devel | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bundler-docUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-irbUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade ruby-libsUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygems-devel | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubyUpgrade rubygem-bson-debuginfoUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade rubygem-xmlrpcNo solution existsUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-mysql2-debugsource | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-mysql2 | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1-develUpgrade libruby2_5-2_5Upgrade ruby2.1Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.5-doc-riUpgrade ruby2.1-stdlib | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.3Upgrade libruby2.5Upgrade libruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub