CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-17790

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.08

EPSS Ranking 91.7%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 7.5

References

Products affected by CVE-2017-17790

Ruby-Lang » Ruby » Version: 2.2.0

cpe:2.3:a:ruby-lang:ruby:2.2.0
Ruby-Lang » Ruby » Version: 2.2.1

cpe:2.3:a:ruby-lang:ruby:2.2.1
Ruby-Lang » Ruby » Version: 2.2.2

cpe:2.3:a:ruby-lang:ruby:2.2.2
Ruby-Lang » Ruby » Version: 2.2.3

cpe:2.3:a:ruby-lang:ruby:2.2.3
Ruby-Lang » Ruby » Version: 2.2.4

cpe:2.3:a:ruby-lang:ruby:2.2.4
Ruby-Lang » Ruby » Version: 2.2.5

cpe:2.3:a:ruby-lang:ruby:2.2.5
Ruby-Lang » Ruby » Version: 2.2.6

cpe:2.3:a:ruby-lang:ruby:2.2.6
Ruby-Lang » Ruby » Version: 2.2.7

cpe:2.3:a:ruby-lang:ruby:2.2.7
Ruby-Lang » Ruby » Version: 2.2.8

cpe:2.3:a:ruby-lang:ruby:2.2.8
Ruby-Lang » Ruby » Version: 2.3.0

cpe:2.3:a:ruby-lang:ruby:2.3.0
Ruby-Lang » Ruby » Version: 2.3.1

cpe:2.3:a:ruby-lang:ruby:2.3.1
Ruby-Lang » Ruby » Version: 2.3.2

cpe:2.3:a:ruby-lang:ruby:2.3.2
Ruby-Lang » Ruby » Version: 2.3.3

cpe:2.3:a:ruby-lang:ruby:2.3.3
Ruby-Lang » Ruby » Version: 2.3.4

cpe:2.3:a:ruby-lang:ruby:2.3.4
Ruby-Lang » Ruby » Version: 2.3.5

cpe:2.3:a:ruby-lang:ruby:2.3.5
Ruby-Lang » Ruby » Version: 2.4.0

cpe:2.3:a:ruby-lang:ruby:2.4.0
Ruby-Lang » Ruby » Version: 2.4.1

cpe:2.3:a:ruby-lang:ruby:2.4.1
Ruby-Lang » Ruby » Version: 2.4.2

cpe:2.3:a:ruby-lang:ruby:2.4.2
Ruby-Lang » Ruby » Version: 2.5.0

cpe:2.3:a:ruby-lang:ruby:2.5.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-17790

Products

Pricing

Contact Us