CVE-2017-0904

Опубликовано: 13 нояб. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Ссылки

https://edoverflow.com/2017/ruby-resolv-bug/
Issue Tracking
Third Party Advisory
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
Third Party Advisory
https://github.com/jtdowney/private_address_check/issues/1
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/287245
Issue Tracking
Mitigation
Patch
Third Party Advisory
https://hackerone.com/reports/287835
Permissions Required
Third Party Advisory
https://edoverflow.com/2017/ruby-resolv-bug/
Issue Tracking
Third Party Advisory
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
Third Party Advisory
https://github.com/jtdowney/private_address_check/issues/1
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/287245
Issue Tracking
Mitigation
Patch
Third Party Advisory
https://hackerone.com/reports/287835
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:private_address_check_project:private_address_check:*:*:*:*:*:ruby:*:*

Версия до 0.4.0 (исключая)

EPSS

Процентиль: 75%

0.00862

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-242

CWE-755

Связанные уязвимости

GHSA-hxhj-hp9m-qwc4

github

около 8 лет назад

private_address_check vulnerable to bypass of Resolv.getaddresses method