CVE-2017-0904

8.1 HIGH
Published: November 13, 2017 Modified: May 13, 2026
View on NVD

Description

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://edoverflow.com/2017/ruby-resolv-bug/
Source: support@hackerone.com
Issue Tracking Third Party Advisory
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
Source: support@hackerone.com
Third Party Advisory
https://github.com/jtdowney/private_address_check/issues/1
Source: support@hackerone.com
Issue Tracking Third Party Advisory
https://hackerone.com/reports/287245
Source: support@hackerone.com
Issue Tracking Mitigation Patch Third Party Advisory
https://hackerone.com/reports/287835
Source: support@hackerone.com
Permissions Required Third Party Advisory
https://edoverflow.com/2017/ruby-resolv-bug/
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Third Party Advisory
https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://github.com/jtdowney/private_address_check/issues/1
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Third Party Advisory
https://hackerone.com/reports/287245
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Mitigation Patch Third Party Advisory
https://hackerone.com/reports/287835
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required Third Party Advisory

10 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.1 / 10.0
EPSS (Exploit Probability)
0.9%
76th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-242 CWE-755

Affected Vendors

private_address_check_project

Related CVEs

CVE-2026-12174 8.8
CVE-2026-12183 9.8
CVE-2026-6428 7.6
CVE-2026-5513 7.2
CVE-2026-1291 4.3