Ruby.Net.FTP.Command.Injection

Description

This indicates a detection of a Command Injection vulnerability in Ruby.
The vulnerability is due to an error in the application when handling a crafted request. It may allow remote attackers to execute arbitrary code on vulnerable systems, via a crafted request.

Affected Products

Ruby 2.2 series: 2.2.8 and earlier
Ruby 2.3 series: 2.3.5 and earlier
Ruby 2.4 series: 2.4.2 and earlier
Ruby 2.5 series: 2.5.0-preview1
prior to trunk revision r61242

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://www.ruby-lang.org/en/downloads/

References