Description
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages1 packages
🔴Vulnerability Details
3GHSAGHSA-47cm-jxff-w8wg: The lazy_initialize function in lib/resolv↗2022-05-14 OSVCVE-2017-17790: The lazy_initialize function in lib/resolv↗2017-12-20 CVEListCVE-2017-17790: The lazy_initialize function in lib/resolv↗2017-12-20 📋Vendor Advisories
2UbuntuRuby vulnerabilities↗2018-01-10 Red Hatruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution↗2017-12-19 💬Community
2BugzillaCVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution [fedora-all]↗2017-12-21 BugzillaCVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution↗2017-12-21