Bug #19479: Support IPv4-mapped IPv6 addresses in IPAddr#private?

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 3.2.1 (2023-02-08 revision 31819e82c8) [x86_64-linux]
• Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN

[tgxworld (Guo Xiang Tan)]

irb(main):010:0> IPAddr.new("172.16.0.0").private?
=> true
irb(main):011:0> IPAddr.new("::ffff:172.16.0.0").private?
=> false

If IPAddr#private? is used in a critical code path, not supporting IPv4-mapped IPv6 addresses could lead to security issues.

[jeremyevans0 (Jeremy Evans)]

I submitted an upstream pull request to fix this: https://github.com/ruby/ipaddr/pull/57

• Status changed from Open to Closed

Applied in changeset git|de51a4a13eab2c4c5917de923edde33dfed6f22f.

---

[ruby/ipaddr] Consider IPv4-mapped IPv6 addresses private if IPv4 address is private

Fixes [Bug #19479]

https://github.com/ruby/ipaddr/commit/7faa0768d3