CVE-2017-17405

CVE-2017-17405 is a Ruby Net::FTP command-injection vulnerability where Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile invoke Kernel#open on local files; if the localfile argument begins with a pipe, the following command is executed. The default localfile is the ba...

CVE-2017-17790

CVE-2017-17790 affects Ruby up to 2.4.3 and is caused by the lazy_initialize function in lib/resolv.rb calling Kernel#open, which may allow command injection. The vulnerability can be triggered by a Resolv::Hosts::new argument that begins with a leading '|' character. The description notes this i...