CVE-2017-17405
Publication date 15 December 2017
Last updated 25 August 2025
Ubuntu priority
Description
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ruby1.9.1 | ||
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Fixed 1.9.3.484-2ubuntu1.6
|
|
| ruby2.0 | ||
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Fixed 2.0.0.484-1ubuntu2.5
|
|
| ruby2.3 | ||
| 16.04 LTS xenial |
Fixed 2.3.1-2~16.04.4
|
|
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.8 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3515-1
- Ruby vulnerability
- 4 January 2018