WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongo | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubyUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-openssl | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby-libsUpgrade rubygemsUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-irbUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsource | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade ruby-develUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-pg-docUpgrade rubygem-net-telnetUpgrade rubygem-irb | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-jsonUpgrade rubygem-json-debuginfoNo solution existsUpgrade rubygem-bson-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-pg-debugsourceUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygemsUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-net-telnetUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-mongo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2 | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.1-develUpgrade ruby2.1 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.5Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub