CVE-2017-0904CWE-242

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not…

published November 13, 2017

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02415 · 84.0th percentile
Weakness
CWE-242 · Use of Inherently Dangerous Function
Published
2017-11-13T17:00Z
EPSS history
Timeline
  • 13 NOV 17:00Z
    The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not…
    cvelistv5