REDHAT-BUG-1528218: Command Injection
The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Upstream bug:
https://github.com/ruby/ruby/pull/1777
Upstream patch:
https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1528218?
The severity of REDHAT-BUG-1528218 is considered critical due to the potential for command injection attacks.
How do I fix REDHAT-BUG-1528218?
To fix REDHAT-BUG-1528218, upgrade Ruby to version 2.5 or later where this vulnerability has been addressed.
What systems are affected by REDHAT-BUG-1528218?
REDHAT-BUG-1528218 affects Ruby versions up to and including 2.4.3.
What is the nature of the attack associated with REDHAT-BUG-1528218?
The nature of the attack associated with REDHAT-BUG-1528218 involves command injection through the use of Kernel#open in the lazy_initialize function.
Is there a workaround for REDHAT-BUG-1528218?
A possible workaround for REDHAT-BUG-1528218 is to avoid the use of the Resolv::Hosts::new method with arguments starting with a '|' character.