PT-2017-3904 · Ruby+5 · Ruby+5
Philcryoport
·
Publicado
2017-12-20
·
Atualizado
2020-06-09
·
CVE-2017-17790
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions prior to 2.4.4
Description
The issue is related to the
lazy initialize function in lib/resolv.rb, which may allow command injection attacks due to the use of Kernel#open. This could be exploited by passing a Resolv::Hosts::new argument starting with a '|' character. The vulnerability is more likely to be exploited in situations where untrusted input is processed.Recommendations
For Ruby versions prior to 2.4.4, update to a version that contains a fix for this issue.
As a temporary workaround, consider avoiding the use of untrusted input in the
Resolv::Hosts::new argument to minimize the risk of exploitation.Exploit
Correção
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Ruby
Suse
Ubuntu