WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrt | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ruby-docUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-net-telnet | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-bson-debuginfoUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-libsUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-psych-debuginfoUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-openssl-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-bson-doc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-docUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceNo solution existsUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade rubygem-irbUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-opensslUpgrade ruby-debugsourceUpgrade rubygem-rdocUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-net-telnet | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade libruby2_1-2_1 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub