[FREEBSD:DD644964-E10E-11E7-8097-0800271D4B9C] ruby -- Command injection vulnerability in Net::FTP

Etienne Stalmans from the Heroku product security team reports:

  There is a command injection vulnerability in Net::FTP bundled with Ruby.
  Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file.  If the localfile argument starts with the pipe character "|", the command following the pipe character is executed.  The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.