Wind River Support Network

HomeDefectsLIN8-8472
Fixed

LIN8-8472 : Security Advisory - ruby - CVE-2017-17790

Created: Dec 29, 2017    Updated: Dec 3, 2018
Resolved Date: Jan 14, 2018
Found In Version: 8.0.0.24
Fix Version: 8.0.0.25
Severity: Standard
Applicable for: Wind River Linux 8
Component/s: Userspace

Description

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

https://nvd.nist.gov/vuln/detail/CVE-2017-17790

Other Downloads


CVEs


Live chat
Online