Command injection vulnerability in Net::FTP(CVE-2017-17405)

There is a command injection vulnerability in Net::FTP bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-17405.

Details

Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character “|”, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

All users running an affected release should upgrade immediately.

Affected Versions

• Ruby 2.2 series: 2.2.8 and earlier
• Ruby 2.3 series: 2.3.5 and earlier
• Ruby 2.4 series: 2.4.2 and earlier
• Ruby 2.5 series: 2.5.0-preview1
• prior to trunk revision r61242