Skip to content
OpenAdvisories

Package · RubyGems

private_address_check

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High —
    CVE-2018-3759

    private_address_check contains race condition

    private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public a…

    HackerOne private_address_check ruby gem private_address_check RubyGems
  • High —
    CVE-2017-0909

    private_address_check contains Incomplete List of Disallowed Inputs

    The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

    HackerOne private_address_check ruby gem private_address_check RubyGems
  • Medium —
    CVE-2017-0904

    private_address_check vulnerable to bypass of Resolv.getaddresses method

    The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to p…

    jtdowney private_address_check ruby gem private_address_check RubyGems