Skip to content
OpenAdvisories
Low ALAS2-2018-983 1 CVE

Low: ruby security update (Amazon Linux 2)

Published Apr 5, 2018 · Updated Sep 23, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-17790: The "lazy_initialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands. 1528218: CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-devel 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-doc 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-irb 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-libs 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-33.amzn2.0.1
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-33.amzn2.0.1
Amazon Linux · 2 rubygem-io-console 0:0.4.2-33.amzn2.0.1
Amazon Linux · 2 rubygem-json 0:1.7.7-33.amzn2.0.1
Amazon Linux · 2 rubygem-minitest 0:4.3.2-33.amzn2.0.1
Amazon Linux · 2 rubygem-psych 0:2.0.0-33.amzn2.0.1
Amazon Linux · 2 rubygem-rake 0:0.9.6-33.amzn2.0.1
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-33.amzn2.0.1
Amazon Linux · 2 rubygems 0:2.0.14.1-33.amzn2.0.1
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-33.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2017-17790

    The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injecti…

    ruby2.3 ruby1.9.1 Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-17790.html