WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-mysql2 | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade ruby-tcltkUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-test-unit | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubyUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-bson-docUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-rake | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-openssl-debuginfoNo solution existsUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bsonUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-abrt-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-pg-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.1-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.1Upgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade libruby2_1-2_1 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade libruby2.5Upgrade libruby2.3Upgrade ruby2.3 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub