CVE-2017-0904 | CVE Tracker

Description

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Scores

CVSS scores of CVE-2017-0904, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.0	High8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 2.4% · top 16% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Weakness

CWE-242: Use of Inherently Dangerous Function (CWE-242) (opens in a new tab)All about CWE-242 and its CVEs
CWE-755 (opens in a new tab)All about CWE-755 and its CVEs

Affected products

jtdowney · private_address_check ruby gem
- affected Versions before 0.4.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

RubyGemsprivate_address_checkGHSA-hxhj-hp9m-qwc4 (opens in a new tab)

References (5)

https://hackerone.com/reports/287245 (opens in a new tab)x_refsource_MISCx_transferred
https://edoverflow.com/2017/ruby-resolv-bug/ (opens in a new tab)x_refsource_MISCx_transferred
https://github.com/jtdowney/private_address_check/issues/1 (opens in a new tab)x_refsource_CONFIRMx_transferred
https://hackerone.com/reports/287835 (opens in a new tab)x_refsource_MISCx_transferred
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2017-0904](https://trackcve.app/badge/CVE-2017-0904.svg)](https://trackcve.app/cve/CVE-2017-0904)

Record last updated 17 Sept 2024, 01:56 UTC.

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is…