Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2017-17790

kritisch

CVE-2017-17790

ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

Veröffentlicht Geändert CWE 74
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Oracle (hoch), Ubuntu (mittel), Red Hat (niedrig), Amazon (niedrig).

Beschreibung

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby20, ruby20-debuginfo, ruby20-devel und 46 weitere2.0.0.648-1.31.amzn1 und 24 weitere
amazon linux 2ruby, ruby-debuginfo, ruby-devel und 13 weitere2.0.0.648-33.amzn2.0.1 und 8 weitere
debian 7ruby1.8, ruby1.9.11.8.7.358-7.1+deb7u5 und 1 weitere
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby, ruby-devel, ruby-doc und 12 weitere2.0.0.648-33.el7_4 und 8 weitere
Red Hatruby, ruby-devel, ruby-docs und 6 weiterekein Fix angegeben
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
Alle 102 Einträge aus 16 Quellen zeigen
QuellePaketBehoben in
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby202.0.0.648-1.31.amzn1
amazon linux 1ruby20-debuginfo2.0.0.648-1.31.amzn1
amazon linux 1ruby20-devel2.0.0.648-1.31.amzn1
amazon linux 1ruby20-doc2.0.0.648-1.31.amzn1
amazon linux 1ruby20-irb2.0.0.648-1.31.amzn1
amazon linux 1ruby20-libs2.0.0.648-1.31.amzn1
amazon linux 1ruby222.2.10-1.11.amzn1
amazon linux 1ruby22-debuginfo2.2.10-1.11.amzn1
amazon linux 1ruby22-devel2.2.10-1.11.amzn1
amazon linux 1ruby22-doc2.2.10-1.11.amzn1
amazon linux 1ruby22-irb2.2.10-1.11.amzn1
amazon linux 1ruby22-libs2.2.10-1.11.amzn1
amazon linux 1ruby232.3.7-1.19.amzn1
amazon linux 1ruby23-debuginfo2.3.7-1.19.amzn1
amazon linux 1ruby23-devel2.3.7-1.19.amzn1
amazon linux 1ruby23-doc2.3.7-1.19.amzn1
amazon linux 1ruby23-irb2.3.7-1.19.amzn1
amazon linux 1ruby23-libs2.3.7-1.19.amzn1
amazon linux 1ruby242.4.4-1.30.6.amzn1
amazon linux 1ruby24-debuginfo2.4.4-1.30.6.amzn1
amazon linux 1ruby24-devel2.4.4-1.30.6.amzn1
amazon linux 1ruby24-doc2.4.4-1.30.6.amzn1
amazon linux 1ruby24-irb2.4.4-1.30.6.amzn1
amazon linux 1ruby24-libs2.4.4-1.30.6.amzn1
amazon linux 1rubygem20-bigdecimal1.2.0-1.31.amzn1
amazon linux 1rubygem20-io-console0.4.2-1.31.amzn1
amazon linux 1rubygem20-psych2.0.0-1.31.amzn1
amazon linux 1rubygem22-bigdecimal1.2.6-1.11.amzn1
amazon linux 1rubygem22-io-console0.4.3-1.11.amzn1
amazon linux 1rubygem22-psych2.0.8.1-1.11.amzn1
amazon linux 1rubygem23-bigdecimal1.2.8-1.19.amzn1
amazon linux 1rubygem23-did_you_mean1.0.0-1.19.amzn1
amazon linux 1rubygem23-io-console0.4.5-1.19.amzn1
amazon linux 1rubygem23-json1.8.3.1-1.19.amzn1
amazon linux 1rubygem23-psych2.1.0.1-1.19.amzn1
amazon linux 1rubygem24-bigdecimal1.3.2-1.30.6.amzn1
amazon linux 1rubygem24-did_you_mean1.1.0-1.30.6.amzn1
amazon linux 1rubygem24-io-console0.4.6-1.30.6.amzn1
amazon linux 1rubygem24-json2.0.4-1.30.6.amzn1
amazon linux 1rubygem24-psych2.2.2-1.30.6.amzn1
amazon linux 1rubygem24-xmlrpc0.2.1-1.30.6.amzn1
amazon linux 1rubygems202.0.14.1-1.31.amzn1
amazon linux 1rubygems20-devel2.0.14.1-1.31.amzn1
amazon linux 1rubygems222.4.5.2-1.11.amzn1
amazon linux 1rubygems22-devel2.4.5.2-1.11.amzn1
amazon linux 1rubygems232.5.2.3-1.19.amzn1
amazon linux 1rubygems23-devel2.5.2.3-1.19.amzn1
amazon linux 1rubygems242.6.14.1-1.30.6.amzn1
amazon linux 1rubygems24-devel2.6.14.1-1.30.6.amzn1
amazon linux 2ruby2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-debuginfo2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-devel2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-doc2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-irb2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-libs2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-tcltk2.0.0.648-33.amzn2.0.1
amazon linux 2rubygem-bigdecimal1.2.0-33.amzn2.0.1
amazon linux 2rubygem-io-console0.4.2-33.amzn2.0.1
amazon linux 2rubygem-json1.7.7-33.amzn2.0.1
amazon linux 2rubygem-minitest4.3.2-33.amzn2.0.1
amazon linux 2rubygem-psych2.0.0-33.amzn2.0.1
amazon linux 2rubygem-rake0.9.6-33.amzn2.0.1
amazon linux 2rubygem-rdoc4.0.0-33.amzn2.0.1
amazon linux 2rubygems2.0.14.1-33.amzn2.0.1
amazon linux 2rubygems-devel2.0.14.1-33.amzn2.0.1
debian 7ruby1.81.8.7.358-7.1+deb7u5
debian 7ruby1.9.11.9.3.194-8.1+deb7u7
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby2.0.0.648-33.el7_4
Oracle Linux 7ruby-devel2.0.0.648-33.el7_4
Oracle Linux 7ruby-doc2.0.0.648-33.el7_4
Oracle Linux 7ruby-irb2.0.0.648-33.el7_4
Oracle Linux 7ruby-libs2.0.0.648-33.el7_4
Oracle Linux 7ruby-tcltk2.0.0.648-33.el7_4
Oracle Linux 7rubygem-bigdecimal1.2.0-33.el7_4
Oracle Linux 7rubygem-io-console0.4.2-33.el7_4
Oracle Linux 7rubygem-json1.7.7-33.el7_4
Oracle Linux 7rubygem-minitest4.3.2-33.el7_4
Oracle Linux 7rubygem-psych2.0.0-33.el7_4
Oracle Linux 7rubygem-rake0.9.6-33.el7_4
Oracle Linux 7rubygem-rdoc4.0.0-33.el7_4
Oracle Linux 7rubygems2.0.14.1-33.el7_4
Oracle Linux 7rubygems-devel2.0.14.1-33.el7_4
Red Hatrubykein Fix angegeben
Red Hatruby-develkein Fix angegeben
Red Hatruby-docskein Fix angegeben
Red Hatruby-irbkein Fix angegeben
Red Hatruby-libskein Fix angegeben
Red Hatruby-rdockein Fix angegeben
Red Hatruby-rikein Fix angegeben
Red Hatruby-statickein Fix angegeben
Red Hatruby-tcltkkein Fix angegeben
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
ubuntu 16.04-ESMruby2.32.3.1-2~16.04.5
ubuntu 17.10ruby2.32.3.3-1ubuntu1.2
ubuntu 18.04ruby2.52.5.1-1
ubuntu 18.04-ESMruby2.52.5.1-1

Referenzen

Alle 15 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.