WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-mysql2 | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-irbUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-bundler | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-bson-debugsourceUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libsUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade rubyUpgrade rubygems-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-doc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-power_assertUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-abrt-docUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-bson-docUpgrade rubygem-rake | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade rubyUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-bson-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoNo solution existsUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-opensslUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psych | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade ruby-libs | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.1-develUpgrade ruby2.5-stdlibUpgrade ruby2.1 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade libruby2.5Upgrade ruby2.3Upgrade libruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub