Skip to content
OpenAdvisories
High USN-3528-1 4 CVEs

ruby1.9.1, ruby2.3 vulnerabilities

Published Jan 10, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby incorrectly handled certain terminal emulator
escape sequences. An attacker could use this to execute arbitrary code via
a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2017-10784)

It was discovered that Ruby incorrectly handled certain strings.
An attacker could use this to cause a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-14033)

It was discovered that Ruby incorrectly handled some generating JSON.
An attacker could use this to possible expose sensitive information.
This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2017-14064)

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code.
(CVE-2017-17790)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ruby1.9.1 1.9.3.484-2ubuntu1.7
Ubuntu · 16.04 LTS 16.04:LTS ruby2.3 2.3.1-2~16.04.5

Vulnerabilities 4

  • High 8.8
    CVE-2017-10784 EPSS 16%

    WEBrick RCE Vulnerability

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2017-14033

    Ruby OpenSSL DoS Vulnerability

    The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

    ruby2.3 ruby ruby1.9.1 ruby2.2 Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2017-14064

    Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate cal…

    ruby2.3 ruby ruby2.0 ruby1.9.1 Ubuntu Alpine
  • Unscored —
    CVE-2017-17790

    The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injecti…

    ruby2.3 ruby1.9.1 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-10784
  • report
    https://ubuntu.com/security/CVE-2017-14033
  • report
    https://ubuntu.com/security/CVE-2017-14064
  • report
    https://ubuntu.com/security/CVE-2017-17790