CVE-2018-3759CWE-362
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being…
published June 13, 2018
What it is
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.00680 · 51.8th percentile
- Weakness
- CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- Published
- 2018-06-13T15:00Z
EPSS history
Timeline