TI-2017-12709 CVE-2017-17405 · GHSA-q23r-c9rf-97q3
Ruby before 2.4.3 allows Net::FTP command injection.
Priority HIGH 76
Ruby before 2.4.3 allows Net::FTP command injection.
RHSA-2018:0584
rh-ruby24-ruby security, bug fix, and enhancement update
Released 2018-03-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ruby24-ruby-2.4.3-90.el6, rh-ruby24-ruby-devel-2.4.3-90.el6, rh-ruby24-ruby-doc-2.4.3-90.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby24-ruby-2.4.3-90.el7, rh-ruby24-ruby-devel-2.4.3-90.el7, rh-ruby24-ruby-doc-2.4.3-90.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-ruby24-ruby-2.4.3-90.el6, rh-ruby24-ruby-devel-2.4.3-90.el6, rh-ruby24-ruby-doc-2.4.3-90.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-ruby24-ruby-2.4.3-90.el7, rh-ruby24-ruby-devel-2.4.3-90.el7, rh-ruby24-ruby-doc-2.4.3-90.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ruby24-ruby-2.4.3-90.el7, rh-ruby24-ruby-devel-2.4.3-90.el7, rh-ruby24-ruby-doc-2.4.3-90.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ruby24-ruby-2.4.3-90.el6, rh-ruby24-ruby-devel-2.4.3-90.el6, rh-ruby24-ruby-doc-2.4.3-90.el6 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby24-ruby-2.4.3-90.el7, rh-ruby24-ruby-devel-2.4.3-90.el7, rh-ruby24-ruby-doc-2.4.3-90.el7 +17
Fixes 2 records
TI-2017-13029 CVE-2017-17790 · GHSA-47cm-jxff-w8wg
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open…
Priority MEDIUM 51
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a differ…