CVE-2017-17790
20.12.2017, 09:29
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
| Vendor | Product | Version |
|---|---|---|
| ruby-lang | ruby | 2.2 ≤ 𝑥 ≤ 2.2.8 |
| ruby-lang | ruby | 2.3 ≤ 𝑥 ≤ 2.3.5 |
| ruby-lang | ruby | 2.4 ≤ 𝑥 ≤ 2.4.2 |
| ruby-lang | ruby | 2.5.0:preview1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
References