WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mongo-docUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-abrt-doc | May 4, 2022 | Nov 26, 2019 |
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 26, 2019 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-tcltk | Sep 28, 2023 | Nov 26, 2019 |
| Amazon_linux | — | Upgrade ruby24 | Sep 1, 2020 | Oct 1, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 26, 2019 |
| Centos_linux | — | Upgrade rubygem-net-telnetUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-irbUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-psych | Jun 30, 2021 | Nov 26, 2019 |
| Debian | — | Upgrade jruby | Nov 27, 2019 | Nov 27, 2019 |
| Freebsd | — | Upgrade ruby | Oct 3, 2019 | Oct 2, 2019 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Mar 16, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Nov 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | Sep 28, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jun 3, 2020 | Nov 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jan 3, 2020 | Nov 26, 2019 |
| Oracle Solaris | — | Upgrade runtime/ruby-25 to version 2.5.7-11.4.19.0.1.2.0 on Solaris 11.4Upgrade runtime/ruby-26 to version 2.6.5-11.4.19.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Nov 26, 2019 |
| Oracle_linux | — | Upgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-psychUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2 | Jul 2, 2021 | Oct 1, 2019 |
| Redhat_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-net-telnetUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-bson-debuginfoUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-pg-debuginfoUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-rakeNo solution existsUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-mysql2-debuginfo | Jun 30, 2021 | Nov 26, 2019 |
| Rocky_linux | — | Upgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debugsource | May 5, 2022 | Nov 26, 2019 |
| Suse | — | Upgrade ruby2.5-docUpgrade ruby2.1Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.1-develUpgrade ruby2.5-doc-riUpgrade ruby2.1-stdlibUpgrade ruby2.5Upgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade libruby2_1-2_1 | Mar 21, 2020 | Oct 1, 2019 |
| Ubuntu | — | Upgrade libruby2.3Upgrade libruby2.5Upgrade ruby2.3Upgrade ruby2.5 | Nov 27, 2019 | Oct 1, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub