Joined: 12 May 2004
|Posted: Tue Feb 20, 2018 3:26 am Post subject: [ GLSA 201802-05 ] Ruby
|Gentoo Linux Security Advisory
Title: Ruby: Command injection (GLSA 201802-05)
A vulnerability has been found in Ruby which may allow for
arbitrary command execution.
Ruby is an interpreted object-oriented programming language. The
elaborate standard library includes an HTTP server (“WEBRick”) and a
class for XML parsing (“REXML”).
Vulnerable: < 2.2.9
Unaffected: >= 2.2.9
Architectures: All supported architectures
A command injection flaw was discovered in Net::FTP which impacts Ruby.
A remote attacker, by enticing a user to download and open a crafted
file from a malicious FTP server, could execute arbitrary commands with
the privileges of the process.
There is no known workaround at this time.
All Ruby users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/ruby-2.2.9:2.2"