CVE-2011-2705
- State
- Published
- Severity
- Not scored
- Published
- Aug 5, 2011
- Updated
- Aug 6, 2024
- Reserved
- Jul 11, 2011
Description
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20110712 Re: CVE Request: ruby PRNG fixesmailing-list
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/
- https://bugzilla.redhat.com/show_bug.cgi?id=722415
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixesmailing-list
- RHSA-2011:1581vendor-advisory
- http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
- FEDORA-2011-9374vendor-advisory
- http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixesmailing-list
- http://redmine.ruby-lang.org/issues/4579
- [oss-security] 20110711 CVE Request: ruby PRNG fixesmailing-list
- 49015vdb-entry
- FEDORA-2011-9359vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.