vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-0904

N/A
Published: November 13, 2017 at 05:00 PM UTC
Updated: June 17, 2026 at 12:58 AM UTC
2 products affected across 2 vendorsPrivate Address CheckAddress Check Project Private Address Check

Using private_address_check ruby gem by jtdowney?

Get instant alerts when new vulnerabilities affect private_address_check ruby gem - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 2%

Description

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Private Address Check· Private Address Check Projectrubygems
95%
v < 0.4.0
Affected range stops below 0.4.0, so it looks safe — our inference, not a vendor statement
Address Check Project Private Address Check· Jtdowney
60%
v < 0.4.0
Affected range stops below 0.4.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_MISCIssue TrackingThird Party Advisory
Source: [email protected]
https://edoverflow.com/2017/ruby-resolv-bug/
x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
x_refsource_CONFIRMIssue TrackingThird Party Advisory
Source: [email protected]
https://github.com/jtdowney/private_address_check/issues/1
x_refsource_MISCIssue TrackingMitigationPatchThird Party Advisory
Source: [email protected]
https://hackerone.com/reports/287245
x_refsource_MISCPermissions RequiredThird Party Advisory
Source: [email protected]
https://hackerone.com/reports/287835

CVSS

6.8MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-242CWE-755

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card