GHSA-3v3c-r5v2-68phHigh

private_address_check contains Incomplete List of Disallowed Inputs

Published
November 30, 2017
Last Modified
January 20, 2023

🔗 CVE IDs covered (1)

CVE-2017-0909 →

📋 Description

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

🎯 Affected products1

  • rubygems/private_address_check:< 0.4.1

🔗 References (4)