CVE-2017-17790: Command Injection
Last updated 25 August 2025
Other sources
The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-17790?
CVE-2017-17790 is a vulnerability in the Ruby programming language that allows for Command Injection attacks.
How does CVE-2017-17790 work?
CVE-2017-17790 works by exploiting the lazy_initialize function in lib/resolv.rb in Ruby through version 2.4.3, which uses Kernel#open and can be abused with a Resolv::Hosts::new argument starting with a '|' character.
How severe is CVE-2017-17790?
CVE-2017-17790 has a severity level of low.
Which versions of Ruby are affected by CVE-2017-17790?
Ruby versions up to and including 2.4.3 are affected by CVE-2017-17790.
How can I fix CVE-2017-17790?
To fix CVE-2017-17790, update Ruby to version 2.5.1-1 or later.