Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Feb 26, 2019 | Dec 15, 2017 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Dec 15, 2017 |
| Centos_linux | — | Upgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-psych | Mar 13, 2018 | Dec 15, 2017 |
| Debian | — | Upgrade ruby1.8Upgrade ruby2.5Upgrade ruby1.9.1 | Aug 2, 2018 | Dec 15, 2017 |
| Freebsd | — | Upgrade ruby | Dec 20, 2017 | Dec 14, 2017 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Feb 20, 2018 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 10, 2019 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | May 10, 2019 | Dec 15, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Dec 15, 2017 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-bigdecimal | Mar 1, 2018 | Dec 14, 2017 |
| Redhat_linux | — | Upgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygemsUpgrade ruby-libsNo solution existsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-rdoc | Mar 1, 2018 | Dec 15, 2017 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby2.1Upgrade yast2-ruby-bindingsUpgrade ruby2.1-stdlibUpgrade libruby2_1-2_1 | Jun 10, 2020 | Dec 15, 2017 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade ruby2.0Upgrade libruby1.9.1Upgrade ruby2.3Upgrade libruby2.3Upgrade libruby2.0Upgrade ruby1.9.3 | Jan 4, 2018 | Dec 15, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub