CVE-2017-0904: jtdowney private_address_check ruby gem Use of Inherently Dangerous Function
Vulnerability summary
CVE-2017-0904 is a high (CVSS 8.1) Use of Inherently Dangerous Function vulnerability in jtdowney private_address_check ruby gem. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.9% of scored vulnerabilities.
Timeline
- 13-11-2017PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.42%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Jtdowney1 product
- private_address_check ruby gemVersions before 0.4.0
Private_address_check_project1 product
- private_address_check< 0.4.0
RubyGems1 product
- private_address_check< 0.4.0
3 vendors · 3 products
References
7 links- github.com/jtdowney/private_address_check/issues/1X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEB
- github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46afX Refsource CONFIRMThird Party AdvisoryWEB
