Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2017-17790

critique

CVE-2017-17790

ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

Publiée Modifiée CWE 74
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Oracle (élevée), Ubuntu (moyenne), Red Hat (faible), Amazon (faible).

Description

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby20, ruby20-debuginfo, ruby20-devel et 46 autres2.0.0.648-1.31.amzn1 et 24 autres
amazon linux 2ruby, ruby-debuginfo, ruby-devel et 13 autres2.0.0.648-33.amzn2.0.1 et 8 autres
debian 7ruby1.8, ruby1.9.11.8.7.358-7.1+deb7u5 et 1 autres
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby, ruby-devel, ruby-doc et 12 autres2.0.0.648-33.el7_4 et 8 autres
Red Hatruby, ruby-devel, ruby-docs et 6 autrespas de correctif indiqué
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
Afficher les 102 entrées de 16 sources
SourcePaquetCorrigé en
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby202.0.0.648-1.31.amzn1
amazon linux 1ruby20-debuginfo2.0.0.648-1.31.amzn1
amazon linux 1ruby20-devel2.0.0.648-1.31.amzn1
amazon linux 1ruby20-doc2.0.0.648-1.31.amzn1
amazon linux 1ruby20-irb2.0.0.648-1.31.amzn1
amazon linux 1ruby20-libs2.0.0.648-1.31.amzn1
amazon linux 1ruby222.2.10-1.11.amzn1
amazon linux 1ruby22-debuginfo2.2.10-1.11.amzn1
amazon linux 1ruby22-devel2.2.10-1.11.amzn1
amazon linux 1ruby22-doc2.2.10-1.11.amzn1
amazon linux 1ruby22-irb2.2.10-1.11.amzn1
amazon linux 1ruby22-libs2.2.10-1.11.amzn1
amazon linux 1ruby232.3.7-1.19.amzn1
amazon linux 1ruby23-debuginfo2.3.7-1.19.amzn1
amazon linux 1ruby23-devel2.3.7-1.19.amzn1
amazon linux 1ruby23-doc2.3.7-1.19.amzn1
amazon linux 1ruby23-irb2.3.7-1.19.amzn1
amazon linux 1ruby23-libs2.3.7-1.19.amzn1
amazon linux 1ruby242.4.4-1.30.6.amzn1
amazon linux 1ruby24-debuginfo2.4.4-1.30.6.amzn1
amazon linux 1ruby24-devel2.4.4-1.30.6.amzn1
amazon linux 1ruby24-doc2.4.4-1.30.6.amzn1
amazon linux 1ruby24-irb2.4.4-1.30.6.amzn1
amazon linux 1ruby24-libs2.4.4-1.30.6.amzn1
amazon linux 1rubygem20-bigdecimal1.2.0-1.31.amzn1
amazon linux 1rubygem20-io-console0.4.2-1.31.amzn1
amazon linux 1rubygem20-psych2.0.0-1.31.amzn1
amazon linux 1rubygem22-bigdecimal1.2.6-1.11.amzn1
amazon linux 1rubygem22-io-console0.4.3-1.11.amzn1
amazon linux 1rubygem22-psych2.0.8.1-1.11.amzn1
amazon linux 1rubygem23-bigdecimal1.2.8-1.19.amzn1
amazon linux 1rubygem23-did_you_mean1.0.0-1.19.amzn1
amazon linux 1rubygem23-io-console0.4.5-1.19.amzn1
amazon linux 1rubygem23-json1.8.3.1-1.19.amzn1
amazon linux 1rubygem23-psych2.1.0.1-1.19.amzn1
amazon linux 1rubygem24-bigdecimal1.3.2-1.30.6.amzn1
amazon linux 1rubygem24-did_you_mean1.1.0-1.30.6.amzn1
amazon linux 1rubygem24-io-console0.4.6-1.30.6.amzn1
amazon linux 1rubygem24-json2.0.4-1.30.6.amzn1
amazon linux 1rubygem24-psych2.2.2-1.30.6.amzn1
amazon linux 1rubygem24-xmlrpc0.2.1-1.30.6.amzn1
amazon linux 1rubygems202.0.14.1-1.31.amzn1
amazon linux 1rubygems20-devel2.0.14.1-1.31.amzn1
amazon linux 1rubygems222.4.5.2-1.11.amzn1
amazon linux 1rubygems22-devel2.4.5.2-1.11.amzn1
amazon linux 1rubygems232.5.2.3-1.19.amzn1
amazon linux 1rubygems23-devel2.5.2.3-1.19.amzn1
amazon linux 1rubygems242.6.14.1-1.30.6.amzn1
amazon linux 1rubygems24-devel2.6.14.1-1.30.6.amzn1
amazon linux 2ruby2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-debuginfo2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-devel2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-doc2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-irb2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-libs2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-tcltk2.0.0.648-33.amzn2.0.1
amazon linux 2rubygem-bigdecimal1.2.0-33.amzn2.0.1
amazon linux 2rubygem-io-console0.4.2-33.amzn2.0.1
amazon linux 2rubygem-json1.7.7-33.amzn2.0.1
amazon linux 2rubygem-minitest4.3.2-33.amzn2.0.1
amazon linux 2rubygem-psych2.0.0-33.amzn2.0.1
amazon linux 2rubygem-rake0.9.6-33.amzn2.0.1
amazon linux 2rubygem-rdoc4.0.0-33.amzn2.0.1
amazon linux 2rubygems2.0.14.1-33.amzn2.0.1
amazon linux 2rubygems-devel2.0.14.1-33.amzn2.0.1
debian 7ruby1.81.8.7.358-7.1+deb7u5
debian 7ruby1.9.11.9.3.194-8.1+deb7u7
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby2.0.0.648-33.el7_4
Oracle Linux 7ruby-devel2.0.0.648-33.el7_4
Oracle Linux 7ruby-doc2.0.0.648-33.el7_4
Oracle Linux 7ruby-irb2.0.0.648-33.el7_4
Oracle Linux 7ruby-libs2.0.0.648-33.el7_4
Oracle Linux 7ruby-tcltk2.0.0.648-33.el7_4
Oracle Linux 7rubygem-bigdecimal1.2.0-33.el7_4
Oracle Linux 7rubygem-io-console0.4.2-33.el7_4
Oracle Linux 7rubygem-json1.7.7-33.el7_4
Oracle Linux 7rubygem-minitest4.3.2-33.el7_4
Oracle Linux 7rubygem-psych2.0.0-33.el7_4
Oracle Linux 7rubygem-rake0.9.6-33.el7_4
Oracle Linux 7rubygem-rdoc4.0.0-33.el7_4
Oracle Linux 7rubygems2.0.14.1-33.el7_4
Oracle Linux 7rubygems-devel2.0.14.1-33.el7_4
Red Hatrubypas de correctif indiqué
Red Hatruby-develpas de correctif indiqué
Red Hatruby-docspas de correctif indiqué
Red Hatruby-irbpas de correctif indiqué
Red Hatruby-libspas de correctif indiqué
Red Hatruby-rdocpas de correctif indiqué
Red Hatruby-ripas de correctif indiqué
Red Hatruby-staticpas de correctif indiqué
Red Hatruby-tcltkpas de correctif indiqué
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
ubuntu 16.04-ESMruby2.32.3.1-2~16.04.5
ubuntu 17.10ruby2.32.3.3-1ubuntu1.2
ubuntu 18.04ruby2.52.5.1-1
ubuntu 18.04-ESMruby2.52.5.1-1

Références

Les 15 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.