Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Feb 26, 2019 | Dec 15, 2017 |
| Apple Osx Ruby | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2018-002 High Sierra | Oct 31, 2018 | Dec 15, 2017 |
| Centos_linux | — | Upgrade rubygemsUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-tcltkUpgrade ruby-develUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-rake | Mar 13, 2018 | Dec 15, 2017 |
| Debian | — | Upgrade ruby1.9.1Upgrade ruby2.5Upgrade ruby1.8 | Aug 2, 2018 | Dec 15, 2017 |
| Freebsd | — | Upgrade ruby | Dec 20, 2017 | Dec 14, 2017 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Feb 20, 2018 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 10, 2019 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | May 10, 2019 | Dec 15, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Dec 15, 2017 |
| Oracle_linux | — | Upgrade rubygem-minitestUpgrade ruby-develUpgrade rubyUpgrade rubygem-rdocUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygems-devel | Mar 1, 2018 | Dec 14, 2017 |
| Redhat_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rdocNo solution existsUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygem-minitest | Mar 1, 2018 | Dec 15, 2017 |
| Suse | — | Upgrade ruby2.1-develUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade yast2-ruby-bindings | Jun 10, 2020 | Dec 15, 2017 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby2.0Upgrade ruby1.9.1Upgrade libruby2.3Upgrade ruby2.3Upgrade ruby1.9.3Upgrade libruby2.0 | Jan 4, 2018 | Dec 15, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub