Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2017-17405

HighPublic exploit

ruby1.9.1 - security update

Published Dec 15, 2017 · Updated Jul 8, 2026 · Also known as ALPINE-CVE-2017-17405, DEBIAN-CVE-2017-17405, DEBIAN-CVE-2017-17790, DLA-1221-1, DLA-1222-1, DSA-4259-1, UBUNTU-CVE-2017-17405, USN-3515-1

Key Facts

Patch immediately
  • CVE-2017-17405 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Ruby (Ruby-Lang), Debian Linux, Enterprise Linux Desktop (Redhat) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 74% probability of exploitation in the next 30 days.
  • Fixed versions are available, including libruby2_1-2_1 2.1.9-19.3.2, rh-ruby22-ruby 0:2.2.9-19.el6, rh-ruby22-ruby 0:2.2.9-19.el7.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

8.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

74%

Higher than 99.4% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2017-17405 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

Affected Products

143 affected entries in total
ProductAffected versionsFixed in
RubyRuby-Lang2.5.0-preview12.2.8
Debian LinuxDebian7.0, 8.0, 9.0n/a
Enterprise Linux DesktopRedhat7.0n/a
Enterprise Linux ServerRedhat7.0n/a
Enterprise Linux Server AusRedhat7.4, 7.6n/a
20 more affected products in the full CVE brief

Patched Releases

libruby2_1-2_1

2.1.9-19.3.2

rh-ruby22-ruby

0:2.2.9-19.el6, 0:2.2.9-19.el7

rh-ruby23-ruby

0:2.3.6-67.el6, 0:2.3.6-67.el7

rh-ruby24-ruby

0:2.4.3-90.el6, 0:2.4.3-90.el7

Ruby

0:2.0.0.648-33.el7_4, 2.0.0.648-33.el7_4, 2.2.9-r0, 2.3.6-r0, 2.4.3-1.ph1, 2.4.3-1.ph2, 2.4.3-r0, 2.5.3-1.ph3, 2.2.8

ruby-devel

2.0.0.648-33.el7_4

ruby-doc

2.0.0.648-33.el7_4

ruby-irb

2.0.0.648-33.el7_4

ruby-libs

2.0.0.648-33.el7_4

ruby-tcltk

2.0.0.648-33.el7_4

ruby1.8

1.8.7.358-7.1+deb7u5

ruby1.9.1

1.9.3.194-8.1+deb7u7, 1.9.3.484-2ubuntu1.6

ruby2.0

2.0.0.484-1ubuntu2.5

ruby2.1

2.1.5-2+deb8u4, 2.1.9-19.3.2

ruby2.1-devel

2.1.9-19.3.2

ruby2.1-stdlib

2.1.9-19.3.2

ruby2.3

2.3.1-2~16.04.4, 2.3.3-1+deb9u3

rubygem-bigdecimal

1.2.0-33.el7_4

rubygem-io-console

0.4.2-33.el7_4

rubygem-json

1.7.7-33.el7_4

rubygem-minitest

4.3.2-33.el7_4

rubygem-psych

2.0.0-33.el7_4

rubygem-rake

0.9.6-33.el7_4

rubygem-rdoc

4.0.0-33.el7_4

rubygems

2.0.14.1-33.el7_4

Timeline

  1. Publicly disclosed

    Dec 15, 2017

  2. Last updated

    Jul 8, 2026

Weakness Type

  • CWE-20 Improper Input Validation
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2017-17405 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo