CVE-2017-17790
Fixed in a distro release EPSS 6%
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Products: ruby-lang ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | ruby | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | ruby-devel | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | ruby-doc | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | ruby-irb | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | ruby-libs | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | ruby-tcltk | 2.0.0.648-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-bigdecimal | 1.2.0-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-io-console | 0.4.2-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-json | 1.7.7-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-minitest | 4.3.2-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-psych | 2.0.0-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-rake | 0.9.6-33.amzn2.0.1 |
| Amazon Linux 2 | rubygem-rdoc | 4.0.0-33.amzn2.0.1 |
| Amazon Linux 2 | rubygems | 2.0.14.1-33.amzn2.0.1 |
| Amazon Linux 2 | rubygems-devel | 2.0.14.1-33.amzn2.0.1 |
| Debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u5 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u7 |
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| Debian 9 | ruby2.3 | 2.3.3-1+deb9u3 |
| Red Hat Enterprise Linux 7 | ruby | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-debuginfo | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-devel | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-doc | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-irb | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-libs | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-tcltk | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-bigdecimal | 0:1.2.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-io-console | 0:0.4.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-json | 0:1.7.7-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-minitest | 0:4.3.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-psych | 0:2.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rake | 0:0.9.6-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rdoc | 0:4.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems | 0:2.0.14.1-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems-devel | 0:2.0.14.1-33.el7_4 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-90.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-90.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-90.el7 |
| SUSE Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.7 |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.5 |