CVE-2017-17790
CriticalSummary
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks. An example is a Resolv::Hosts::new argument beginning with a '|' character.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized commands on the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update Ruby to a version that does not contain this vulnerability and to avoid using untrusted input in the lazy_initialize function.
Original NVD description (English source)
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.