private_address_check vulnerable to bypass of Resolv.getaddresses method (GHSA-hxhj-hp9m-qwc4)
Published: 2017-11-29T23:21:05Z
Aliases: CVE-2017-0904
Severity: MODERATE · CWE: CWE-242

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's `Resolv.getaddresses` method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Affected packages:
package: ecosystem: RubyGems
name: private_address_check
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.0