There is a command injection vulnerability in Net::FTP bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2017-17405.
Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character "|", the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
All users running an affected release should upgrade immediately.
Ruby 2.2 series: 2.2.8 and earlier
Ruby 2.3 series: 2.3.5 and earlier
Ruby 2.4 series: 2.4.2 and earlier
Fixed versions are available:
Since 2.2.9 only contains the single fix to Net::FTP we can proceed with stabling right away.
sparc stable (thanks to Rolf Eike Beer)
vulnerable versions have been removed
GLSA request filed.
This issue was resolved and addressed in
GLSA 201802-05 at https://security.gentoo.org/glsa/201802-05
by GLSA coordinator Thomas Deutschmann (whissi).