WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-mongo | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-tcltkUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-irbUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-json | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-bson-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade ruby-libs-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubyUpgrade ruby-irbUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade ruby-doc | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubyUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade ruby-irb | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoNo solution existsUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubyUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bson-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-abrt-doc | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfo | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.5-docUpgrade ruby2.1-develUpgrade ruby2.1Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extra | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub