WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-mongo | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-net-telnet | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-mongoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-bson-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-bundler-docUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsource | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygemsUpgrade ruby-irbUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade ruby-develUpgrade ruby-libsUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-mongo-docUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-bson-docUpgrade rubygem-rdoc | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygemsUpgrade ruby-debugsourceUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-mongoUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonNo solution existsUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-bundlerUpgrade rubygem-abrt | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.1-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.1Upgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade ruby2.5-doc-riUpgrade libruby2_1-2_1Upgrade yast2-ruby-bindingsUpgrade ruby2.5-devel | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.5Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub