WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-bson | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubygem-net-telnetUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubyUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade ruby-doc | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade ruby-irbUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-abrt-doc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubyUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-psych | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-abrt-docUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade rubygem-abrtNo solution existsUpgrade rubygem-bsonUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade rubygem-mongo-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-io-console | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-devel | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade ruby2.5-develUpgrade libruby2_1-2_1Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.1Upgrade libruby2_5-2_5Upgrade ruby2.1-devel | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub