CVE-2011-3009 Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number....
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.8.6 | No fix listed |
| ruby-lang ruby | = 1.8.6-p110 | No fix listed |
| ruby-lang ruby | = 1.8.6-p36 | No fix listed |
References
- redmine.ruby-lang.org
- RHSA-2012:0070 vendor-advisory
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list patch
- RHSA-2011:1581 vendor-advisory
- 49126 vdb-entry
- ruby-random-number-weak-security(69157) vdb-entry