CVE-2017-17790
20.12.2017, 09:29
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ruby-lang | ruby | 2.2 ≤ 𝑥 ≤ 2.2.8 |
| ruby-lang | ruby | 2.3 ≤ 𝑥 ≤ 2.3.5 |
| ruby-lang | ruby | 2.4 ≤ 𝑥 ≤ 2.4.2 |
| ruby-lang | ruby | 2.5.0:preview1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| libruby2_1-2_1 |
| ||||||||||
| yast2-ruby-bindings |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| ruby |
| ||
| ruby-devel |
| ||
| ruby-doc |
| ||
| ruby-irb |
| ||
| ruby-libs |
| ||
| ruby-tcltk |
| ||
| rubygem-bigdecimal |
| ||
| rubygem-io-console |
| ||
| rubygem-json |
| ||
| rubygem-minitest |
| ||
| rubygem-psych |
| ||
| rubygem-rake |
| ||
| rubygem-rdoc |
| ||
| rubygems |
| ||
| rubygems-devel |
|
References