PT-2017-10704 · Ruby · Private Address Check

Edoverflow · Published 2017-11-13 · Updated 2019-10-09 · CVE-2017-0904

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions private address check ruby gem versions prior to 0.4.0

Description The issue arises from the use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures. This method is used to blacklist private network addresses to prevent server-side request forgery, but its OS-dependent nature makes it unsuitable for such security purposes.

Recommendations For private address check ruby gem versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the Resolv.getaddresses method until a patch is available. Restrict access to private network addresses to minimize the risk of server-side request forgery.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-242

CWE-755

Related Identifiers

CVE-2017-0904

GHSA-HXHJ-HP9M-QWC4

Affected Products

Private Address Check

References · 8

• https://hackerone.com/reports/287245 · Patch
• https://osv.dev/vulnerability/GHSA-hxhj-hp9m-qwc4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0904 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0904 · Vendor Advisory
• https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af · Note
• https://github.com/jtdowney/private_address_check/issues/1 · Note
• https://edoverflow.com/2017/ruby-resolv-bug · Note
• https://hackerone.com/reports/287835 · Note