Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Feb 26, 2019 | Dec 15, 2017 |
| Apple Osx Ruby | — | Apply Apple macOS Security Update 2018-002 High SierraUpgrade macOS to the latest version | Oct 31, 2018 | Dec 15, 2017 |
| Centos_linux | — | Upgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-libsUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade ruby-irbUpgrade rubygem-json | Mar 13, 2018 | Dec 15, 2017 |
| Debian | — | Upgrade ruby2.5Upgrade ruby1.8Upgrade ruby1.9.1 | Aug 2, 2018 | Dec 15, 2017 |
| Freebsd | — | Upgrade ruby | Dec 20, 2017 | Dec 14, 2017 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Feb 20, 2018 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | May 10, 2019 | Dec 15, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | May 10, 2019 | Dec 15, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Dec 15, 2017 |
| Oracle_linux | — | Upgrade rubygemsUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-develUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-docUpgrade rubygem-rake | Mar 1, 2018 | Dec 14, 2017 |
| Redhat_linux | — | No solution existsUpgrade rubygem-psychUpgrade rubygemsUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubygem-io-console | Mar 1, 2018 | Dec 15, 2017 |
| Suse | — | Upgrade yast2-ruby-bindingsUpgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby2.1-devel | Jun 10, 2020 | Dec 15, 2017 |
| Ubuntu | — | Upgrade ruby2.0Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade libruby2.3Upgrade ruby2.3Upgrade libruby2.0 | Jan 4, 2018 | Dec 15, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub