| Package | Affected versions | Patched versions |
|---|---|---|
| ruby | = 2.5.0≥ 2.2, ≤ 2.2.8≥ 2.3, ≤ 2.3.5≥ 2.4, ≤ 2.4.2 |
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free