There is a command injection vulnerability in Net::FTP bundled with Ruby. This vulnerability has been assigned the CVE identifier [CVE-2017-17405](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17405).
### Details
`Net::FTP#get`, `getbinaryfile`, `gettextfile`, `put`, `putbinaryfile`, and `puttextfile` use `Kernel#open` to open a local file. If the `localfile` argument starts with the pipe character "`|`", the command following the pipe character is executed. The default value of `localfile` is `File.basename(remotefile)`, so malicious FTP servers could cause arbitrary command execution.
All users running an affected release should upgrade immediately.
### Affected Versions
* Ruby 2.2 series: 2.2.8 and earlier
* Ruby 2.3 series: 2.3.5 and earlier
* Ruby 2.4 series: 2.4.2 and earlier
* Ruby 2.5 series: 2.5.0-preview1
* prior to trunk revision r61242
暂无评论