CVE-2017-17405

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get,
getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use
Kernel#open to open a local file. If the localfile argument starts with the
“|” pipe character, the command following the pipe character is executed.
The default value of localfile is File.basename(remotefile), so malicious
FTP servers could cause arbitrary command execution.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884438&gt;