CVE-2011-2705

EUVD-2011-2686
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
ruby-langruby
𝑥
≤ 1.8.7-334
ruby-langruby
1.8.7:p22
ruby-langruby
1.8.7:p71
ruby-langruby
1.8.7:p72
ruby-langruby
1.8.7-160
ruby-langruby
1.8.7-173
ruby-langruby
1.8.7-248
ruby-langruby
1.8.7-249
ruby-langruby
1.8.7-299
ruby-langruby
1.8.7-302
ruby-langruby
1.8.7-330
ruby-langruby
1.8.7-p21
ruby-langruby
1.9
ruby-langruby
1.9:r18423
ruby-langruby
1.9.0
ruby-langruby
1.9.0:r18423
ruby-langruby
1.9.0-0
ruby-langruby
1.9.0-1
ruby-langruby
1.9.0-2
ruby-langruby
1.9.0-20060415
ruby-langruby
1.9.0-20070709
ruby-langruby
1.9.1
ruby-langruby
1.9.1:-p0
ruby-langruby
1.9.1:-p129
ruby-langruby
1.9.1:-p243
ruby-langruby
1.9.1:-p376
ruby-langruby
1.9.1:-p429
ruby-langruby
1.9.1:-preview_1
ruby-langruby
1.9.1:-preview_2
ruby-langruby
1.9.1:-rc1
ruby-langruby
1.9.1:-rc2
ruby-langruby
1.9.2
ruby-langruby
1.9.2:dev
ruby-langruby
1.9.2-p136
ruby-langruby
1.9.2-p180
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.8
hardy
ignored
lucid
Fixed 1.8.7.249-2ubuntu0.1
released
maverick
Fixed 1.8.7.299-2ubuntu0.1
released
natty
Fixed 1.8.7.302-2ubuntu0.1
released
oneiric
not-affected
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
ruby1.9
hardy
ignored
lucid
ignored
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
ruby1.9.1
hardy
dne
lucid
ignored
maverick
ignored
natty
ignored
oneiric
not-affected
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html
http://redmine.ruby-lang.org/issues/4579
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog
http://www.openwall.com/lists/oss-security/2011/07/11/1
http://www.openwall.com/lists/oss-security/2011/07/12/14
http://www.openwall.com/lists/oss-security/2011/07/20/1
http://www.openwall.com/lists/oss-security/2011/07/20/16
http://www.redhat.com/support/errata/RHSA-2011-1581.html
http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/
http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/
http://www.securityfocus.com/bid/49015
https://bugzilla.redhat.com/show_bug.cgi?id=722415
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html
http://redmine.ruby-lang.org/issues/4579
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog
http://www.openwall.com/lists/oss-security/2011/07/11/1
http://www.openwall.com/lists/oss-security/2011/07/12/14
http://www.openwall.com/lists/oss-security/2011/07/20/1
http://www.openwall.com/lists/oss-security/2011/07/20/16
http://www.redhat.com/support/errata/RHSA-2011-1581.html
http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/
http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/
http://www.securityfocus.com/bid/49015
https://bugzilla.redhat.com/show_bug.cgi?id=722415