CVE-2017-17790 Command injection in n/a
Command injection in Ruby's resolv library allows code execution via malicious hostnames, though untrusted input scenarios are unlikely.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-17790?
CVE-2017-17790 is a critical command injection vulnerability in Ruby-Lang Ruby, published on 20 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Weakness: CWE-74
Which versions are affected by CVE-2017-17790?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2017-17790?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-17790 being exploited?
There is no known exploitation of CVE-2017-17790 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as GHSA-47cm-jxff-w8wg, UBUNTU-CVE-2017-17790.