CVE-2017-17790

CRITICAL

Ruby < 2.4.3 - Command Injection via Resolv::Hosts::new Argument

Title source: llm

Description

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

References (9)

Core 9

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0585

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0378

Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm

https://github.com/ruby/ruby/pull/1777

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0584

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0583

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2018/dsa-4259

Scores

CVSS v3 9.8

EPSS 0.0591

EPSS Percentile 92.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-74

Status published

Products (2)

ruby-lang/ruby 2.5.0 preview1

ruby-lang/ruby 2.2 - 2.2.8

Published Dec 20, 2017

Tracked Since Feb 18, 2026