CVE-2017-17790

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type

GIT

Repo

https://github.com/ruby/ruby

Events

Introduced

7393bf6a5cfff63683f36535e293caaa0d4c5be0

Last affected

f3c3c788aa458ec9d57035c8f3091093bfcb9fa7

Introduced

d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20

Last affected

e07613e27ee9445abad9c6981e8d721a0df39f1c

Introduced

d4bb726b713658f56e630b6cf817a0155b6f390e

Last affected

595af866bb46db24274dc26fb9b4d3af84fd0af5

Introduced

Last affected

f11fbd79fd7000550188cfe19d04cce9f472d26b

Database specific

{
    "versions": [
        {
            "introduced": "2.2"
        },
        {
            "last_affected": "2.2.8"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3.5"
        },
        {
            "introduced": "2.4"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.0-preview1"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17790.json"