CVE-2019-16201

Name of the Vulnerable Software and Affected Versions Ruby versions 2.4.7 and earlier, 2.5.x through 2.5.6, 2.6.x through 2.6.4

Description The issue is related to a regular expression Denial of Service caused by looping/backtracking in the WEBrick::HTTPAuth::DigestAuth class in Ruby. This can be exploited by a remote attacker to cause a denial of service if a victim exposes a WEBrick server that uses DigestAuth to the Internet or an untrusted network.

Recommendations For Ruby versions 2.4.7 and earlier: update to a version later than 2.4.7 to resolve the issue. For Ruby versions 2.5.x through 2.5.6: update to a version later than 2.5.6 to resolve the issue. For Ruby versions 2.6.x through 2.6.4: update to a version later than 2.6.4 to resolve the issue. As a temporary workaround, consider disabling the WEBrick::HTTPAuth::DigestAuth class until a patch is available.