crítica
CVE-2017-17790
ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Photon OS. Más baja según Oracle (alta), Ubuntu (media), Red Hat (baja), Amazon (baja).
Descripción
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | ruby | 2.4.3-2.ph1 |
| Photon OS 2.0 | ruby | 2.4.3-2.ph2 |
| Photon OS 3.0 | ruby | 2.5.3-1.ph3 |
| amazon linux 1 | ruby20, ruby20-debuginfo, ruby20-devel y 46 más | 2.0.0.648-1.31.amzn1 y 24 más |
| amazon linux 2 | ruby, ruby-debuginfo, ruby-devel y 13 más | 2.0.0.648-33.amzn2.0.1 y 8 más |
| debian 7 | ruby1.8, ruby1.9.1 | 1.8.7.358-7.1+deb7u5 y 1 más |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| Oracle Linux 7 | ruby, ruby-devel, ruby-doc y 12 más | 2.0.0.648-33.el7_4 y 8 más |
| Red Hat | ruby, ruby-devel, ruby-docs y 6 más | sin corrección indicada |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.7 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.5 |
Mostrar las 102 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Photon OS 1.0 | ruby | 2.4.3-2.ph1 |
| Photon OS 2.0 | ruby | 2.4.3-2.ph2 |
| Photon OS 3.0 | ruby | 2.5.3-1.ph3 |
| amazon linux 1 | ruby20 | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-debuginfo | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-devel | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-doc | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-irb | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby20-libs | 2.0.0.648-1.31.amzn1 |
| amazon linux 1 | ruby22 | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-debuginfo | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-devel | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-doc | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-irb | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby22-libs | 2.2.10-1.11.amzn1 |
| amazon linux 1 | ruby23 | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-debuginfo | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-devel | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-doc | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-irb | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby23-libs | 2.3.7-1.19.amzn1 |
| amazon linux 1 | ruby24 | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-debuginfo | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-devel | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-doc | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-irb | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | ruby24-libs | 2.4.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem20-bigdecimal | 1.2.0-1.31.amzn1 |
| amazon linux 1 | rubygem20-io-console | 0.4.2-1.31.amzn1 |
| amazon linux 1 | rubygem20-psych | 2.0.0-1.31.amzn1 |
| amazon linux 1 | rubygem22-bigdecimal | 1.2.6-1.11.amzn1 |
| amazon linux 1 | rubygem22-io-console | 0.4.3-1.11.amzn1 |
| amazon linux 1 | rubygem22-psych | 2.0.8.1-1.11.amzn1 |
| amazon linux 1 | rubygem23-bigdecimal | 1.2.8-1.19.amzn1 |
| amazon linux 1 | rubygem23-did_you_mean | 1.0.0-1.19.amzn1 |
| amazon linux 1 | rubygem23-io-console | 0.4.5-1.19.amzn1 |
| amazon linux 1 | rubygem23-json | 1.8.3.1-1.19.amzn1 |
| amazon linux 1 | rubygem23-psych | 2.1.0.1-1.19.amzn1 |
| amazon linux 1 | rubygem24-bigdecimal | 1.3.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-did_you_mean | 1.1.0-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-io-console | 0.4.6-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-json | 2.0.4-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-psych | 2.2.2-1.30.6.amzn1 |
| amazon linux 1 | rubygem24-xmlrpc | 0.2.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems20 | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems20-devel | 2.0.14.1-1.31.amzn1 |
| amazon linux 1 | rubygems22 | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems22-devel | 2.4.5.2-1.11.amzn1 |
| amazon linux 1 | rubygems23 | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems23-devel | 2.5.2.3-1.19.amzn1 |
| amazon linux 1 | rubygems24 | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 1 | rubygems24-devel | 2.6.14.1-1.30.6.amzn1 |
| amazon linux 2 | ruby | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-debuginfo | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-devel | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-doc | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-irb | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-libs | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | ruby-tcltk | 2.0.0.648-33.amzn2.0.1 |
| amazon linux 2 | rubygem-bigdecimal | 1.2.0-33.amzn2.0.1 |
| amazon linux 2 | rubygem-io-console | 0.4.2-33.amzn2.0.1 |
| amazon linux 2 | rubygem-json | 1.7.7-33.amzn2.0.1 |
| amazon linux 2 | rubygem-minitest | 4.3.2-33.amzn2.0.1 |
| amazon linux 2 | rubygem-psych | 2.0.0-33.amzn2.0.1 |
| amazon linux 2 | rubygem-rake | 0.9.6-33.amzn2.0.1 |
| amazon linux 2 | rubygem-rdoc | 4.0.0-33.amzn2.0.1 |
| amazon linux 2 | rubygems | 2.0.14.1-33.amzn2.0.1 |
| amazon linux 2 | rubygems-devel | 2.0.14.1-33.amzn2.0.1 |
| debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u5 |
| debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u7 |
| debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| Oracle Linux 7 | ruby | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-devel | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-doc | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-irb | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-libs | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | ruby-tcltk | 2.0.0.648-33.el7_4 |
| Oracle Linux 7 | rubygem-bigdecimal | 1.2.0-33.el7_4 |
| Oracle Linux 7 | rubygem-io-console | 0.4.2-33.el7_4 |
| Oracle Linux 7 | rubygem-json | 1.7.7-33.el7_4 |
| Oracle Linux 7 | rubygem-minitest | 4.3.2-33.el7_4 |
| Oracle Linux 7 | rubygem-psych | 2.0.0-33.el7_4 |
| Oracle Linux 7 | rubygem-rake | 0.9.6-33.el7_4 |
| Oracle Linux 7 | rubygem-rdoc | 4.0.0-33.el7_4 |
| Oracle Linux 7 | rubygems | 2.0.14.1-33.el7_4 |
| Oracle Linux 7 | rubygems-devel | 2.0.14.1-33.el7_4 |
| Red Hat | ruby | sin corrección indicada |
| Red Hat | ruby-devel | sin corrección indicada |
| Red Hat | ruby-docs | sin corrección indicada |
| Red Hat | ruby-irb | sin corrección indicada |
| Red Hat | ruby-libs | sin corrección indicada |
| Red Hat | ruby-rdoc | sin corrección indicada |
| Red Hat | ruby-ri | sin corrección indicada |
| Red Hat | ruby-static | sin corrección indicada |
| Red Hat | ruby-tcltk | sin corrección indicada |
| ubuntu 14.04 | ruby1.9.1 | 1.9.3.484-2ubuntu1.7 |
| ubuntu 16.04 | ruby2.3 | 2.3.1-2~16.04.5 |
| ubuntu 16.04-ESM | ruby2.3 | 2.3.1-2~16.04.5 |
| ubuntu 17.10 | ruby2.3 | 2.3.3-1ubuntu1.2 |
| ubuntu 18.04 | ruby2.5 | 2.5.1-1 |
| ubuntu 18.04-ESM | ruby2.5 | 2.5.1-1 |
Referencias
- https://access.redhat.com/errata/RHSA-2018:0378
- https://access.redhat.com/errata/RHSA-2018:0583
- https://access.redhat.com/errata/RHSA-2018:0584
- https://access.redhat.com/errata/RHSA-2018:0585
- https://access.redhat.com/security/cve/CVE-2017-17790
- https://github.com/ruby/ruby/pull/1777
- https://linux.oracle.com/cve/CVE-2017-17790.html
- https://linux.oracle.com/errata/ELSA-2018-0378.html
Las 15 referencias
- https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html
- https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-17790
- https://ubuntu.com/security/notices/USN-3528-1
- https://www.cve.org/CVERecord?id=CVE-2017-17790
- https://www.debian.org/security/2018/dsa-4259