CVE-2011-2686 Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number....
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.8.7-334 | No fix listed |
| ruby-lang ruby | = 1.8.7-p22 | No fix listed |
| ruby-lang ruby | = 1.8.7-p71 | No fix listed |
| ruby-lang ruby | = 1.8.7-p72 | No fix listed |
| ruby-lang ruby | = 1.8.7-160 | No fix listed |
| ruby-lang ruby | = 1.8.7-173 | No fix listed |
| ruby-lang ruby | = 1.8.7-248 | No fix listed |
| ruby-lang ruby | = 1.8.7-249 | No fix listed |
| ruby-lang ruby | = 1.8.7-299 | No fix listed |
| ruby-lang ruby | = 1.8.7-302 | No fix listed |
| ruby-lang ruby | = 1.8.7-330 | No fix listed |
| ruby-lang ruby | = 1.8.7-p21 | No fix listed |
References
- FEDORA-2011-9374 patch vendor-advisory
- FEDORA-2011-9359 patch vendor-advisory
- redmine.ruby-lang.org
- svn.ruby-lang.org patch
- svn.ruby-lang.org
- [oss-security] 20110711 CVE Request: ruby PRNG fixes mailing-list patch
- [oss-security] 20110712 Re: CVE Request: ruby PRNG fixes mailing-list patch
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list patch
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list patch
- www.ruby-lang.org patch
- 49015 vdb-entry
- bugzilla.redhat.com patch
- ruby-random-number-dos(69032) vdb-entry