Command Injection Vulnerabilities in ruby1.8
Summary
DLA-1222-1: ruby1.8 - security update. Affects ruby1.8 versions < 1.8.7.358-7.1+deb7u5. Fixed in 1.8.7.358-7.1+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby1.8 is an interpreter for the Ruby language. It is used to execute Ruby code and provides various functionalities for developers. This vulnerability affects version 1.8.7.358-7.1+deb7u5 of the package in Debian 7 Wheezy.
Vulnerability Detail
Two command injection vulnerabilities have been discovered in ruby1.8:
-
CVE-2017-17405: This vulnerability exists in the Net::FTP module and allows a malicious FTP server to execute arbitrary commands on the system.
-
CVE-2017-17790: This vulnerability exists in the lib/resolv.rb's lazy_initialize function and allows for a command injection attack. However, the likelihood of untrusted input reaching this function is low.
How To Fix
Minimum fixed version
1.8.7.358-7.1+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Two command injection vulnerabilities have been discovered in ruby1.8. It is crucial to upgrade to version 1.8.7.358-7.1+deb7u5 or later to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby1.8 →
FAQ
ruby1.8 is an interpreter for the Ruby language, used to execute Ruby code.
CVE-2017-17405 allows a malicious FTP server to execute arbitrary commands on the system.
CVE-2017-17790 allows for a command injection attack, but the likelihood of untrusted input reaching the vulnerable function is low.
You can upgrade your ruby1.8 package by following the standard package upgrade process for your operating system.
No specific workaround has been provided for these vulnerabilities. It is recommended to upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.8.
