High severity8.8NVD Advisory· Published Dec 15, 2017· Updated Jun 17, 2026

CVE-2017-17405

Description

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ruby Lang/Ruby2 versions
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*range: >=2.2,<=2.2.8
- cpe:2.3:a:ruby-lang:ruby:2.5.0:preview1:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus2 versions
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus3 versions
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus2 versions
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
ruby-git/ruby-gitllm-fuzzy
Range: <2.4.3
osv-coords21 versions
pkg:rpm/suse/ruby2.1&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/ruby2.1&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/ruby2.1&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/ruby2.1&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/yast2-ruby-bindings&distro=SUSE%20OpenStack%20Cloud%207
< 2.1.9-19.3.2+ 20 more
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 2.1.9-19.3.2
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1
- (no CPE)range: < 3.1.53-9.8.1

Patches

Vulnerability mechanics

References

www.ruby-lang.org/en/news/2017/12/14/ruby-2-4-3-released/nvdPatchRelease NotesVendor Advisory
www.exploit-db.com/exploits/43381/nvdExploitThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/102204nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1042004nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:0378nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:0583nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:0584nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:0585nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2017/12/msg00024.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2017/12/msg00025.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlnvdMailing ListThird Party Advisory
www.debian.org/security/2018/dsa-4259nvdThird Party Advisory
www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/nvdVendor Advisory
access.redhat.com/errata/RHSA-2019:2806nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.059
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000