{"schema_version":"1.7.5","id":"CVE-2017-17405","published":"2017-12-15T09:29:00.203Z","modified":"2026-07-08T05:49:52.445045170Z","related":["SUSE-SU-2020:1570-1"],"details":"Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the \"|\" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/ruby","events":[{"introduced":"7393bf6a5cfff63683f36535e293caaa0d4c5be0"},{"last_affected":"f3c3c788aa458ec9d57035c8f3091093bfcb9fa7"},{"introduced":"d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20"},{"last_affected":"e07613e27ee9445abad9c6981e8d721a0df39f1c"},{"introduced":"d4bb726b713658f56e630b6cf817a0155b6f390e"},{"last_affected":"595af866bb46db24274dc26fb9b4d3af84fd0af5"},{"introduced":"f11fbd79fd7000550188cfe19d04cce9f472d26b"},{"last_affected":"f11fbd79fd7000550188cfe19d04cce9f472d26b"}],"database_specific":{"cpe":["cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","cpe:2.3:a:ruby-lang:ruby:2.5.0:preview1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.2"},{"last_affected":"2.2.8"},{"introduced":"2.3"},{"last_affected":"2.3.5"},{"introduced":"2.4"},{"last_affected":"2.4.2"},{"introduced":"2.5.0-preview1"},{"last_affected":"2.5.0-preview1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["2.5.0-preview1","v2_5_0_preview1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-17405.json"}}],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/102204"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1042004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0378"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0583"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0584"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2806"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00024.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00025.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4259"},{"type":"ADVISORY","url":"https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/"},{"type":"FIX","url":"https://www.ruby-lang.org/en/news/2017/12/14/ruby-2-4-3-released/"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/43381/"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.5"},{"last_affected":"7.5"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_eus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.4"},{"last_affected":"7.4"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}