CVE-2018-3759 private_address_check contains race condition

What is CVE-2018-3759?

CVE-2018-3759 is a low-severity vulnerability in HackerOne private_address_check ruby gem, published on 13 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

Weakness: CWE-362

Which versions are affected by CVE-2018-3759?

2 open source packages ship an affected version, including private_address_check. It affects 1 product.

Products include Private Address Check Project Private Address Check.

How do I fix CVE-2018-3759?

Upgrade private_address_check to 0.5.0 or later.

Is CVE-2018-3759 being exploited?

There is no known exploitation of CVE-2018-3759 in the wild and no public exploit code.

Other vulnerabilities in HackerOne private_address_check ruby gem

• CVE-2017-0909 private_address_check contains Incomplete List of Disallowed Inputs Critical 9.8
• CVE-2017-0904 private_address_check vulnerable to bypass of Resolv.getaddresses method High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2xvj-j3qh-x8c3.