CVE-2011-2705

Ruby < 1.8.7-334 and 1.9.x < 1.9.2-p290 - Predictable SecureRandom Output via PID-Based Initialization

Title source: llm
STIX 2.1

Description

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

References (15)

Core 15
Core References
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/12/14
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/20/16
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1581.html
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/20/1
Issue Tracking x_refsource_confirm
http://redmine.ruby-lang.org/issues/4579
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/11/1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/49015
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html

Scores

EPSS 0.0195
EPSS Percentile 77.9%

Details

CWE
CWE-20
Status published
Products (21)
ruby-lang/ruby 1.8.7 p22 (3 CPE variants)
ruby-lang/ruby 1.8.7-160
ruby-lang/ruby 1.8.7-173
ruby-lang/ruby 1.8.7-248
ruby-lang/ruby 1.8.7-249
ruby-lang/ruby 1.8.7-299
ruby-lang/ruby 1.8.7-302
ruby-lang/ruby 1.8.7-330
ruby-lang/ruby 1.8.7-p21
ruby-lang/ruby 1.9 (2 CPE variants)
... and 11 more
Published Aug 05, 2011
Tracked Since Feb 18, 2026