WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-mongo-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubyUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-openssl | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-abrt-doc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubyUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-psych | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rakeNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade ruby-irb | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-psych-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-io-console | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade yast2-ruby-bindingsUpgrade ruby2.5Upgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.1-develUpgrade ruby2.1Upgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade ruby2.5Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub