CVE-2017-0904

State: Published
Severity: Not scored
Published: Nov 13, 2017
Updated: Sep 17, 2024
Reserved: Nov 30, 2016

Description

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Scores

The record has no CVSS score.

Weaknesses

CWE-242 Use of Inherently Dangerous Function (CWE-242)

Affected Products

Product	Versions
private_address_check ruby gemjtdowney	Versions before 0.4.0Affected

References

https://hackerone.com/reports/287245
https://edoverflow.com/2017/ruby-resolv-bug/
https://github.com/jtdowney/private_address_check/issues/1
https://hackerone.com/reports/287835
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.