PT-2017-10704 · Ruby · Private Address Check

Edoverflow · Publicado 2017-11-13 · Atualizado 2019-10-09 · CVE-2017-0904

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions private address check ruby gem versions prior to 0.4.0

Description The issue arises from the use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures. This method is used to blacklist private network addresses to prevent server-side request forgery, but its OS-dependent nature makes it unsuitable for such security purposes.

Recommendations For private address check ruby gem versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the Resolv.getaddresses method until a patch is available. Restrict access to private network addresses to minimize the risk of server-side request forgery.

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-242

CWE-755

Identificadores relacionados

CVE-2017-0904

GHSA-HXHJ-HP9M-QWC4

Produtos afetados

Private Address Check

Referências · 8

• https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af · Nota
• https://github.com/jtdowney/private_address_check/issues/1 · Nota
• https://hackerone.com/reports/287245 · Correção
• https://osv.dev/vulnerability/GHSA-hxhj-hp9m-qwc4 · Aviso do Fabricante
• https://edoverflow.com/2017/ruby-resolv-bug · Nota
• https://hackerone.com/reports/287835 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-0904 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0904 · Aviso do Fabricante