{"id":"CVE-2017-17790","details":"The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.","modified":"2026-04-09T05:21:45.926333Z","published":"2017-12-20T09:29:01.477Z","related":["MGASA-2017-0486","SUSE-SU-2020:1570-1"],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0378"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0584"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0585"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4259"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0583"},{"type":"REPORT","url":"https://github.com/ruby/ruby/pull/1777"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/ruby","events":[{"introduced":"7393bf6a5cfff63683f36535e293caaa0d4c5be0"},{"last_affected":"f3c3c788aa458ec9d57035c8f3091093bfcb9fa7"},{"introduced":"d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20"},{"last_affected":"e07613e27ee9445abad9c6981e8d721a0df39f1c"},{"introduced":"d4bb726b713658f56e630b6cf817a0155b6f390e"},{"last_affected":"595af866bb46db24274dc26fb9b4d3af84fd0af5"},{"introduced":"0"},{"last_affected":"f11fbd79fd7000550188cfe19d04cce9f472d26b"}],"database_specific":{"versions":[{"introduced":"2.2"},{"last_affected":"2.2.8"},{"introduced":"2.3"},{"last_affected":"2.3.5"},{"introduced":"2.4"},{"last_affected":"2.4.2"},{"introduced":"0"},{"last_affected":"2.5.0-preview1"}]}}],"versions":["v1_0_r2","v2_2_0_rc1","v2_2_8","v2_3_5","v2_4_2","v2_5_0_preview1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17790.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}