Wind River Support Network

HomeDefectsLIN9-6120
Fixed

LIN9-6120 : Security Advisory - ruby - CVE-2017-17790

Created: Dec 29, 2017    Updated: Dec 3, 2018
Resolved Date: Jan 16, 2018
Found In Version: 9.0.0.13
Fix Version: 9.0.0.14
Severity: Standard
Applicable for: Wind River Linux 9
Component/s: Userspace

Description

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

https://nvd.nist.gov/vuln/detail/CVE-2017-17790

Other Downloads


CVEs


Live chat
Online