The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade ruby-libsUpgrade ruby-develUpgrade rubyUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-io-console | Apr 27, 2020 | Dec 20, 2017 |
| Amazon_linux | — | Upgrade ruby23Upgrade ruby22Upgrade ruby20Upgrade ruby24 | Apr 6, 2018 | Dec 20, 2017 |
| Centos_linux | — | Upgrade rubyUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygems-develUpgrade ruby-debuginfo | Mar 13, 2018 | Dec 20, 2017 |
| Debian | — | Upgrade ruby1.8Upgrade ruby2.5Upgrade ruby1.9.1 | Aug 2, 2018 | Dec 20, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ruby-irbUpgrade ruby-libsUpgrade ruby | Jan 30, 2018 | Dec 20, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 30, 2018 | Dec 20, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Dec 20, 2017 |
| Oracle_linux | — | Upgrade rubygemsUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygems-develUpgrade ruby-tcltkUpgrade ruby-doc | Mar 1, 2018 | Dec 19, 2017 |
| Redhat_linux | — | Upgrade rubygem-psychUpgrade rubyUpgrade rubygem-minitestNo solution existsUpgrade ruby-develUpgrade rubygemsUpgrade ruby-tcltkUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-debuginfo | Mar 1, 2018 | Dec 20, 2017 |
| Suse | — | Upgrade ruby2.1Upgrade ruby2.1-develUpgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlib | Jun 10, 2020 | Dec 20, 2017 |
| Ubuntu | — | Upgrade ruby2.3Upgrade libruby2.3Upgrade ruby1.9.3Upgrade libruby1.9.1Upgrade ruby1.9.1 | Jan 11, 2018 | Dec 20, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 20, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub