LOW🇬🇧 English

CVE-2018-3759

CVSS 3.7v3.0pub. 2018-06-13upd. 2024-11-21

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Private Address Check Project Private Address Check

    APP
    Private Address Check Project
    < 0.5.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Race Condition
CWE
Referencje

Powiązane podatności

CVE-2017-0909CRITICAL9.8ten sam produkt

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of co...

CVE-2017-0904HIGH8.1ten sam produkt

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddre...