Command Injection Vulnerabilities in ruby1.9.1
Summary
DLA-1221-1: ruby1.9.1 - security update. Affects ruby1.9.1 versions < 1.9.3.194-8.1+deb7u7. Fixed in 1.9.3.194-8.1+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby1.9.1 is an interpreter for the Ruby language. It is used to execute Ruby code and provides various functionalities for developers. The package is commonly used in Debian 7 Wheezy. However, several vulnerabilities have been discovered in this version of ruby1.9.1.
Vulnerability Detail
The identified vulnerabilities in ruby1.9.1 are as follows:
-
CVE-2017-17405: A command injection vulnerability in Net::FTP allows a malicious FTP server to execute arbitrary commands.
-
CVE-2017-17790: A command injection vulnerability in lib/resolv.rb's lazy_initialize function may allow a command injection attack. However, the likelihood of untrusted input to this function is rather low.
How To Fix
Minimum fixed version
1.9.3.194-8.1+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
In conclusion, ruby1.9.1 in Debian 7 Wheezy is affected by command injection vulnerabilities (CVE-2017-17405 and CVE-2017-17790). Upgrading to version 1.9.3.194-8.1+deb7u7 or later is recommended to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby1.9.1 →
FAQ
CVE-2017-17405 allows a malicious FTP server to execute arbitrary commands on the affected system. This can lead to unauthorized access, data manipulation, or even complete system compromise.
Exploiting CVE-2017-17790 requires untrusted input to the lib/resolv.rb's lazy_initialize function. The likelihood of such input being provided is relatively low, reducing the risk of an attack.
Yes, upgrading to version 1.9.3.194-8.1+deb7u7 or later fixes the identified vulnerabilities in ruby1.9.1.
There is no information available regarding active exploitation of these vulnerabilities at the time of this report.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.9.1.
