CVE-2017-17790 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 92%

Affected Products (NVD)

Vendor	Product	Version
ruby-lang	ruby	2.2 ≤ 𝑥 ≤ 2.2.8
ruby-lang	ruby	2.3 ≤ 𝑥 ≤ 2.3.5
ruby-lang	ruby	2.4 ≤ 𝑥 ≤ 2.4.2
ruby-lang	ruby	2.5.0:preview1

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

ruby1.9.1

artful	dne
bionic	dne
trusty	Fixed 1.9.3.484-2ubuntu1.7 released
xenial	dne
zesty	dne

ruby2.3

artful	Fixed 2.3.3-1ubuntu1.2 released
bionic	dne
trusty	dne
xenial	Fixed 2.3.1-2~16.04.5 released
zesty	ignored

ruby2.5

artful	dne
bionic	Fixed 2.5.1-1 released
trusty	dne
xenial	dne
zesty	dne

openSUSE / SLES Releases

openSUSE Product

Release

libruby2_1-2_1

suse enterprise sap 12 SP4	2.1.9-19.3.2 fixed
suse enterprise sap 12 SP5	2.1.9-19.3.2 fixed
suse enterprise server 12 SP2	2.1.9-19.3.2 fixed
suse enterprise server 12 SP3	2.1.9-19.3.2 fixed
suse enterprise server 12 SP5	2.1.9-19.3.2 fixed

yast2-ruby-bindings

suse enterprise server 12 SP2

3.1.53-9.8.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

ruby

RHEL 7

0:2.0.0.648-33.el7_4

fixed

ruby-devel

RHEL 7

0:2.0.0.648-33.el7_4

fixed

ruby-doc

RHEL 7

0:2.0.0.648-33.el7_4

fixed

ruby-irb

RHEL 7

0:2.0.0.648-33.el7_4

fixed

ruby-libs

RHEL 7

0:2.0.0.648-33.el7_4

fixed

ruby-tcltk

RHEL 7

0:2.0.0.648-33.el7_4

fixed

rubygem-bigdecimal

RHEL 7

0:1.2.0-33.el7_4

fixed

rubygem-io-console

RHEL 7

0:0.4.2-33.el7_4

fixed

rubygem-json

RHEL 7

0:1.7.7-33.el7_4

fixed

rubygem-minitest

RHEL 7

0:4.3.2-33.el7_4

fixed

rubygem-psych

RHEL 7

0:2.0.0-33.el7_4

fixed

rubygem-rake

RHEL 7

0:0.9.6-33.el7_4

fixed

rubygem-rdoc

RHEL 7

0:4.0.0-33.el7_4

fixed

rubygems

RHEL 7

0:2.0.14.1-33.el7_4

fixed

rubygems-devel

RHEL 7

0:2.0.14.1-33.el7_4

fixed

Amazon Linux Releases

Amazon Package

Release

ruby

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-debuginfo

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-devel

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-doc

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-irb

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-libs

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby-tcltk

Amazon Linux 2

0:2.0.0.648-33.amzn2.0.1

fixed

ruby20

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby20-debuginfo

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby20-devel

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby20-doc

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby20-irb

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby20-libs

Amazon Linux 1

0:2.0.0.648-1.31.amzn1

fixed

ruby22

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby22-debuginfo

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby22-devel

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby22-doc

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby22-irb

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby22-libs

Amazon Linux 1

0:2.2.10-1.11.amzn1

fixed

ruby23

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby23-debuginfo

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby23-devel

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby23-doc

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby23-irb

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby23-libs

Amazon Linux 1

0:2.3.7-1.19.amzn1

fixed

ruby24

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

ruby24-debuginfo

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

ruby24-devel

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

ruby24-doc

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

ruby24-irb

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

ruby24-libs

Amazon Linux 1

0:2.4.4-1.30.6.amzn1

fixed

rubygem-bigdecimal

Amazon Linux 2

0:1.2.0-33.amzn2.0.1

fixed

rubygem-io-console

Amazon Linux 2

0:0.4.2-33.amzn2.0.1

fixed

rubygem-json

Amazon Linux 2

0:1.7.7-33.amzn2.0.1

fixed

rubygem-minitest

Amazon Linux 2

0:4.3.2-33.amzn2.0.1

fixed

rubygem-psych

Amazon Linux 2

0:2.0.0-33.amzn2.0.1

fixed

rubygem-rake

Amazon Linux 2

0:0.9.6-33.amzn2.0.1

fixed

rubygem-rdoc

Amazon Linux 2

0:4.0.0-33.amzn2.0.1

fixed

rubygem20-bigdecimal

Amazon Linux 1

0:1.2.0-1.31.amzn1

fixed

rubygem20-io-console

Amazon Linux 1

0:0.4.2-1.31.amzn1

fixed

rubygem20-psych

Amazon Linux 1

0:2.0.0-1.31.amzn1

fixed

rubygem22-bigdecimal

Amazon Linux 1

0:1.2.6-1.11.amzn1

fixed

rubygem22-io-console

Amazon Linux 1

0:0.4.3-1.11.amzn1

fixed

rubygem22-psych

Amazon Linux 1

0:2.0.8.1-1.11.amzn1

fixed

rubygem23-bigdecimal

Amazon Linux 1

0:1.2.8-1.19.amzn1

fixed

rubygem23-did_you_mean

Amazon Linux 1

0:1.0.0-1.19.amzn1

fixed

rubygem23-io-console

Amazon Linux 1

0:0.4.5-1.19.amzn1

fixed

rubygem23-json

Amazon Linux 1

0:1.8.3.1-1.19.amzn1

fixed

rubygem23-psych

Amazon Linux 1

0:2.1.0.1-1.19.amzn1

fixed

rubygem24-bigdecimal

Amazon Linux 1

0:1.3.2-1.30.6.amzn1

fixed

rubygem24-did_you_mean

Amazon Linux 1

0:1.1.0-1.30.6.amzn1

fixed

rubygem24-io-console

Amazon Linux 1

0:0.4.6-1.30.6.amzn1

fixed

rubygem24-json

Amazon Linux 1

0:2.0.4-1.30.6.amzn1

fixed

rubygem24-psych

Amazon Linux 1

0:2.2.2-1.30.6.amzn1

fixed

rubygem24-xmlrpc

Amazon Linux 1

0:0.2.1-1.30.6.amzn1

fixed

rubygems

Amazon Linux 2

0:2.0.14.1-33.amzn2.0.1

fixed

rubygems-devel

Amazon Linux 2

0:2.0.14.1-33.amzn2.0.1

fixed

rubygems20

Amazon Linux 1

0:2.0.14.1-1.31.amzn1

fixed

rubygems20-devel

Amazon Linux 1

0:2.0.14.1-1.31.amzn1

fixed

rubygems22

Amazon Linux 1

0:2.4.5.2-1.11.amzn1

fixed

rubygems22-devel

Amazon Linux 1

0:2.4.5.2-1.11.amzn1

fixed

rubygems23

Amazon Linux 1

0:2.5.2.3-1.19.amzn1

fixed

rubygems23-devel

Amazon Linux 1

0:2.5.2.3-1.19.amzn1

fixed

rubygems24

Amazon Linux 1

0:2.6.14.1-1.30.6.amzn1

fixed

rubygems24-devel

Amazon Linux 1

0:2.6.14.1-1.30.6.amzn1

fixed

Known Exploits!

Common Weakness Enumeration

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References

https://access.redhat.com/errata/RHSA-2018:0378

https://access.redhat.com/errata/RHSA-2018:0583

https://access.redhat.com/errata/RHSA-2018:0584

https://access.redhat.com/errata/RHSA-2018:0585

https://github.com/ruby/ruby/pull/1777

https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html

https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

https://www.debian.org/security/2018/dsa-4259

https://access.redhat.com/errata/RHSA-2018:0378

https://access.redhat.com/errata/RHSA-2018:0583

https://access.redhat.com/errata/RHSA-2018:0584

https://access.redhat.com/errata/RHSA-2018:0585

https://github.com/ruby/ruby/pull/1777

https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html

https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

https://www.debian.org/security/2018/dsa-4259