GitHub Advisoryadvisory · RubyGems

GHSA-3v3c-r5v2-68ph private_address_check contains Incomplete List of Disallowed Inputs

HIGH Published 2017-11-30 Modified 2023-01-20 Official page ↗
Aliases
CVE-2017-0909
Ecosystem
RubyGems
Packages
private_address_check
Severity
High
Weaknesses
CWE-184
Reviewed
2020-06-16

Affected packages

• RubyGems private_address_check: < 0.4.1 → fixed in 0.4.1

Description

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

Related

Alias · CVE (1)

  • CVE-2017-0909 The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network… vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References