GitHub Advisoryadvisory · RubyGems

GHSA-hxhj-hp9m-qwc4 private_address_check vulnerable to bypass of Resolv.getaddresses method

MEDIUM Published 2017-11-29 Modified 2023-01-23 Official page ↗
Aliases
CVE-2017-0904
Ecosystem
RubyGems
Packages
private_address_check
Severity
Moderate
Weaknesses
CWE-242
Reviewed
2020-06-16

Affected packages

• RubyGems private_address_check: < 0.4.0 → fixed in 0.4.0

Description

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's `Resolv.getaddresses` method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Related

Alias · CVE (1)

  • CVE-2017-0904 The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is… vulnerability

Weakness · CWE (1)

  • CWE-242 Use of Inherently Dangerous Function weakness

References