CVE-2017-17790

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
2.2 ≤
𝑥
≤ 2.2.8
ruby-langruby
2.3 ≤
𝑥
≤ 2.3.5
ruby-langruby
2.4 ≤
𝑥
≤ 2.4.2
ruby-langruby
2.5.0:preview1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.9.1
artful
dne
bionic
dne
trusty
Fixed 1.9.3.484-2ubuntu1.7
released
xenial
dne
zesty
dne
ruby2.3
artful
Fixed 2.3.3-1ubuntu1.2
released
bionic
dne
trusty
dne
xenial
Fixed 2.3.1-2~16.04.5
released
zesty
ignored
ruby2.5
artful
dne
bionic
Fixed 2.5.1-1
released
trusty
dne
xenial
dne
zesty
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libruby2_1-2_1
suse enterprise sap 12 SP4
2.1.9-19.3.2
fixed
suse enterprise sap 12 SP5
2.1.9-19.3.2
fixed
suse enterprise server 12 SP2
2.1.9-19.3.2
fixed
suse enterprise server 12 SP3
2.1.9-19.3.2
fixed
suse enterprise server 12 SP5
2.1.9-19.3.2
fixed
yast2-ruby-bindings
suse enterprise server 12 SP2
3.1.53-9.8.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
ruby
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-devel
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-doc
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-irb
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-libs
RHEL 7
0:2.0.0.648-33.el7_4
fixed
ruby-tcltk
RHEL 7
0:2.0.0.648-33.el7_4
fixed
rubygem-bigdecimal
RHEL 7
0:1.2.0-33.el7_4
fixed
rubygem-io-console
RHEL 7
0:0.4.2-33.el7_4
fixed
rubygem-json
RHEL 7
0:1.7.7-33.el7_4
fixed
rubygem-minitest
RHEL 7
0:4.3.2-33.el7_4
fixed
rubygem-psych
RHEL 7
0:2.0.0-33.el7_4
fixed
rubygem-rake
RHEL 7
0:0.9.6-33.el7_4
fixed
rubygem-rdoc
RHEL 7
0:4.0.0-33.el7_4
fixed
rubygems
RHEL 7
0:2.0.14.1-33.el7_4
fixed
rubygems-devel
RHEL 7
0:2.0.14.1-33.el7_4
fixed