ruby2.5: CVE-2017-17790: fixed command injection

Debian Bug report logs - #884878
ruby2.5: CVE-2017-17790: fixed command injection

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ruby2.5: CVE-2017-17790: fixed command injection

Date: Wed, 20 Dec 2017 22:31:24 +0100

Source: ruby2.5
Version: 2.5.0~preview1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/ruby/ruby/pull/1777
Control: clone -1 -2
Control: reassign -2 ruby2.3 2.3.5-1
Control: found -2 2.3.3-1
Control: retitle -2 ruby2.3: CVE-2017-17790: fixed command injection

Hi,

the following vulnerability was published for ruby2.5.

CVE-2017-17790[0]:
| The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3
| uses Kernel#open, which might allow Command Injection attacks, as
| demonstrated by a Resolv::Hosts::new argument beginning with a '|'
| character, a different vulnerability than CVE-2017-17405. NOTE:
| situations with untrusted input may be highly unlikely.

As already mentioned in the CVE description, it's quite unlikely that
there is external input fed to Resolv::Hosts. But a fix can be
included in any future DSA as well.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17790
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17790
[1] https://github.com/ruby/ruby/pull/1777
[2] https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7

Regards,
Salvatore

Message #18 received at 884878-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 884878-submitter@bugs.debian.org

Subject: closing 884878

Date: Sun, 25 Feb 2018 17:14:42 +0100

close 884878 2.5.0-1
thanks

Send a report that this bug log contains spam.