private_address_check contains race condition

低 3.7CVE-2018-3759 · GHSA-2xvj-j3qh-x8c3 · 13/06/2018 公開 · 17/06/2026 更新

要点

CVE-2018-3759 は private_address_check, private address check (private address check project) に影響する深刻度「低」 (CVSS 3.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.68%（全脆弱性の 52.6% より高い）。
対処：0.5.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
private_address_check RubyGems	`< 0.5.0`	`0.5.0`
private address check private_address_check_project	`< 0.5.0`	`0.5.0`

概要

The private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

NVD の説明

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.