Vulnetix
Try Vulnetix Request Demo
CVE-2017-17405 PUBLISHED

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

EPSS 88.65% · 99.5th percentile

Risk Scores

EPSS Score
88.65%
99.5th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSruby2.32.3.1-2~16.04.2, 2.3.1-2~16.04, 2.3.0-5ubuntu1
Ubuntu:14.04:LTSruby1.9.11.9.3.484-2ubuntu1.2, 1.9.3.484-2ubuntu1.3, 1.9.3.484-2ubuntu1.5
Ubuntu:14.04:LTSruby2.02.0.0.484-1ubuntu2.1, 2.0.0.484-1ubuntu2.2, 2.0.0.484-1ubuntu2.4

Timeline

References

Open in Interactive Console →