Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2017-17790

critical

CVE-2017-17790

ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

Published Modified CWE 74
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Oracle (high), Ubuntu (medium), Red Hat (low), Amazon (low).

Description

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby20, ruby20-debuginfo, ruby20-devel and 46 more2.0.0.648-1.31.amzn1 and 24 more
amazon linux 2ruby, ruby-debuginfo, ruby-devel and 13 more2.0.0.648-33.amzn2.0.1 and 8 more
debian 7ruby1.8, ruby1.9.11.8.7.358-7.1+deb7u5 and 1 more
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby, ruby-devel, ruby-doc and 12 more2.0.0.648-33.el7_4 and 8 more
Red Hatruby, ruby-devel, ruby-docs and 6 moreno fix listed
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
Show all 102 entries from 16 sources
SourcePackageFixed in
Photon OS 1.0ruby2.4.3-2.ph1
Photon OS 2.0ruby2.4.3-2.ph2
Photon OS 3.0ruby2.5.3-1.ph3
amazon linux 1ruby202.0.0.648-1.31.amzn1
amazon linux 1ruby20-debuginfo2.0.0.648-1.31.amzn1
amazon linux 1ruby20-devel2.0.0.648-1.31.amzn1
amazon linux 1ruby20-doc2.0.0.648-1.31.amzn1
amazon linux 1ruby20-irb2.0.0.648-1.31.amzn1
amazon linux 1ruby20-libs2.0.0.648-1.31.amzn1
amazon linux 1ruby222.2.10-1.11.amzn1
amazon linux 1ruby22-debuginfo2.2.10-1.11.amzn1
amazon linux 1ruby22-devel2.2.10-1.11.amzn1
amazon linux 1ruby22-doc2.2.10-1.11.amzn1
amazon linux 1ruby22-irb2.2.10-1.11.amzn1
amazon linux 1ruby22-libs2.2.10-1.11.amzn1
amazon linux 1ruby232.3.7-1.19.amzn1
amazon linux 1ruby23-debuginfo2.3.7-1.19.amzn1
amazon linux 1ruby23-devel2.3.7-1.19.amzn1
amazon linux 1ruby23-doc2.3.7-1.19.amzn1
amazon linux 1ruby23-irb2.3.7-1.19.amzn1
amazon linux 1ruby23-libs2.3.7-1.19.amzn1
amazon linux 1ruby242.4.4-1.30.6.amzn1
amazon linux 1ruby24-debuginfo2.4.4-1.30.6.amzn1
amazon linux 1ruby24-devel2.4.4-1.30.6.amzn1
amazon linux 1ruby24-doc2.4.4-1.30.6.amzn1
amazon linux 1ruby24-irb2.4.4-1.30.6.amzn1
amazon linux 1ruby24-libs2.4.4-1.30.6.amzn1
amazon linux 1rubygem20-bigdecimal1.2.0-1.31.amzn1
amazon linux 1rubygem20-io-console0.4.2-1.31.amzn1
amazon linux 1rubygem20-psych2.0.0-1.31.amzn1
amazon linux 1rubygem22-bigdecimal1.2.6-1.11.amzn1
amazon linux 1rubygem22-io-console0.4.3-1.11.amzn1
amazon linux 1rubygem22-psych2.0.8.1-1.11.amzn1
amazon linux 1rubygem23-bigdecimal1.2.8-1.19.amzn1
amazon linux 1rubygem23-did_you_mean1.0.0-1.19.amzn1
amazon linux 1rubygem23-io-console0.4.5-1.19.amzn1
amazon linux 1rubygem23-json1.8.3.1-1.19.amzn1
amazon linux 1rubygem23-psych2.1.0.1-1.19.amzn1
amazon linux 1rubygem24-bigdecimal1.3.2-1.30.6.amzn1
amazon linux 1rubygem24-did_you_mean1.1.0-1.30.6.amzn1
amazon linux 1rubygem24-io-console0.4.6-1.30.6.amzn1
amazon linux 1rubygem24-json2.0.4-1.30.6.amzn1
amazon linux 1rubygem24-psych2.2.2-1.30.6.amzn1
amazon linux 1rubygem24-xmlrpc0.2.1-1.30.6.amzn1
amazon linux 1rubygems202.0.14.1-1.31.amzn1
amazon linux 1rubygems20-devel2.0.14.1-1.31.amzn1
amazon linux 1rubygems222.4.5.2-1.11.amzn1
amazon linux 1rubygems22-devel2.4.5.2-1.11.amzn1
amazon linux 1rubygems232.5.2.3-1.19.amzn1
amazon linux 1rubygems23-devel2.5.2.3-1.19.amzn1
amazon linux 1rubygems242.6.14.1-1.30.6.amzn1
amazon linux 1rubygems24-devel2.6.14.1-1.30.6.amzn1
amazon linux 2ruby2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-debuginfo2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-devel2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-doc2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-irb2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-libs2.0.0.648-33.amzn2.0.1
amazon linux 2ruby-tcltk2.0.0.648-33.amzn2.0.1
amazon linux 2rubygem-bigdecimal1.2.0-33.amzn2.0.1
amazon linux 2rubygem-io-console0.4.2-33.amzn2.0.1
amazon linux 2rubygem-json1.7.7-33.amzn2.0.1
amazon linux 2rubygem-minitest4.3.2-33.amzn2.0.1
amazon linux 2rubygem-psych2.0.0-33.amzn2.0.1
amazon linux 2rubygem-rake0.9.6-33.amzn2.0.1
amazon linux 2rubygem-rdoc4.0.0-33.amzn2.0.1
amazon linux 2rubygems2.0.14.1-33.amzn2.0.1
amazon linux 2rubygems-devel2.0.14.1-33.amzn2.0.1
debian 7ruby1.81.8.7.358-7.1+deb7u5
debian 7ruby1.9.11.9.3.194-8.1+deb7u7
debian 8ruby2.12.1.5-2+deb8u4
debian 9ruby2.32.3.3-1+deb9u3
Oracle Linux 7ruby2.0.0.648-33.el7_4
Oracle Linux 7ruby-devel2.0.0.648-33.el7_4
Oracle Linux 7ruby-doc2.0.0.648-33.el7_4
Oracle Linux 7ruby-irb2.0.0.648-33.el7_4
Oracle Linux 7ruby-libs2.0.0.648-33.el7_4
Oracle Linux 7ruby-tcltk2.0.0.648-33.el7_4
Oracle Linux 7rubygem-bigdecimal1.2.0-33.el7_4
Oracle Linux 7rubygem-io-console0.4.2-33.el7_4
Oracle Linux 7rubygem-json1.7.7-33.el7_4
Oracle Linux 7rubygem-minitest4.3.2-33.el7_4
Oracle Linux 7rubygem-psych2.0.0-33.el7_4
Oracle Linux 7rubygem-rake0.9.6-33.el7_4
Oracle Linux 7rubygem-rdoc4.0.0-33.el7_4
Oracle Linux 7rubygems2.0.14.1-33.el7_4
Oracle Linux 7rubygems-devel2.0.14.1-33.el7_4
Red Hatrubyno fix listed
Red Hatruby-develno fix listed
Red Hatruby-docsno fix listed
Red Hatruby-irbno fix listed
Red Hatruby-libsno fix listed
Red Hatruby-rdocno fix listed
Red Hatruby-rino fix listed
Red Hatruby-staticno fix listed
Red Hatruby-tcltkno fix listed
ubuntu 14.04ruby1.9.11.9.3.484-2ubuntu1.7
ubuntu 16.04ruby2.32.3.1-2~16.04.5
ubuntu 16.04-ESMruby2.32.3.1-2~16.04.5
ubuntu 17.10ruby2.32.3.3-1ubuntu1.2
ubuntu 18.04ruby2.52.5.1-1
ubuntu 18.04-ESMruby2.52.5.1-1

References

All 15 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.