The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-tcltkUpgrade rubygemsUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubyUpgrade rubygem-minitest | Apr 27, 2020 | Dec 20, 2017 |
| Amazon_linux | — | Upgrade ruby20Upgrade ruby24Upgrade ruby22Upgrade ruby23 | Apr 6, 2018 | Dec 20, 2017 |
| Centos_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubyUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-rdocUpgrade rubygems | Mar 13, 2018 | Dec 20, 2017 |
| Debian | — | Upgrade ruby1.8Upgrade ruby2.5Upgrade ruby1.9.1 | Aug 2, 2018 | Dec 20, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-libs | Jan 30, 2018 | Dec 20, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Jan 30, 2018 | Dec 20, 2017 |
| Oracle Solaris | — | Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Dec 20, 2017 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby | Mar 1, 2018 | Dec 19, 2017 |
| Redhat_linux | — | Upgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-irbUpgrade ruby-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygemsNo solution existsUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-psychUpgrade ruby-tcltk | Mar 1, 2018 | Dec 20, 2017 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.1-develUpgrade yast2-ruby-bindings | Jun 10, 2020 | Dec 20, 2017 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby1.9.3Upgrade ruby2.3Upgrade libruby2.3 | Jan 11, 2018 | Dec 20, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 20, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub