CVE-2017-0904

High

Published: 13/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The private_address_check ruby gem before version 0.4.0 is vulnerable to a bypass due to the use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as blacklisting private network addresses to prevent server-side request forgery.

Risk Assessment

Organizations may be exposed to server-side request forgery attacks, potentially leading to unauthorized access to internal resources.

Recommendation

It is recommended to update the private_address_check gem to version 0.4.0 or later and implement additional security measures to protect against server-side request forgery.

Other vulnerabilities in private_address_check ruby gem

CVE-2017-0909Critical
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

Original NVD description (English source)

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.