Race Condition Vulnerability in private_address_check Ruby Gem by jtdowney
CVE-2018-3759

3.7LOW

Key Information:

Vendor

Hackerone

Status
Private Address Check Ruby Gem
Vendor
CVE Published:
13 June 2018

What is CVE-2018-3759?

The private_address_check Ruby gem is affected by a race condition vulnerability due to improper socket address checks. This issue arises when DNS entries with a Time-To-Live (TTL) of 0 are involved, leading to a scenario where the initial DNS resolution may yield a public address, while the subsequent resolution could return a private address. This inconsistency can lead to unexpected behaviors and security implications, particularly when the gem is in use for network applications. The vulnerability exists in versions prior to 0.5.0, making it crucial for users to update their implementations to the latest version to mitigate risks.

Affected Version(s)

private_address_check ruby gem 0.5.0

References

https://github.com/jtdowney/private_address_check/commit/...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.