CVE-2019-16201 — Improper Authentication in Ruby
Severity
7.5HIGHNVD
OSV6.5
EPSS
0.6%
top 30.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 26
Latest updateMay 24
Description
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages2 packages
Also affects: Debian Linux 8.0
🔴Vulnerability Details
4📋Vendor Advisories
4Microsoft▶
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick↗2019-11-12
Red Hat▶
ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication↗2019-10-01
Debian▶
CVE-2019-16201: jruby - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2....↗2019