CVEvulnerability
CVE-2011-2686
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-08-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Affected configurations
• ruby-lang ruby (<= 1.8.7-334)
• ruby-lang ruby 1.8.7
• ruby-lang ruby 1.8.7-160
• ruby-lang ruby 1.8.7-173
• ruby-lang ruby 1.8.7-248
• ruby-lang ruby 1.8.7-249
• ruby-lang ruby 1.8.7-299
• ruby-lang ruby 1.8.7-302
• ruby-lang ruby 1.8.7-330
• ruby-lang ruby 1.8.7-p21
Related
Weakness · not in database (1)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html Patch
- http://redmine.ruby-lang.org/issues/show/4338 redmine.ruby-lang.org
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713 Patch
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog svn.ruby-lang.org
- http://www.openwall.com/lists/oss-security/2011/07/11/1 Patch
- http://www.openwall.com/lists/oss-security/2011/07/12/14 Patch
- http://www.openwall.com/lists/oss-security/2011/07/20/1 Patch
- http://www.openwall.com/lists/oss-security/2011/07/20/16 Patch
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ Patch
- http://www.securityfocus.com/bid/49015 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=722415 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69032 exchange.xforce.ibmcloud.com
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html Patch
- http://redmine.ruby-lang.org/issues/show/4338 redmine.ruby-lang.org
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713 Patch
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog svn.ruby-lang.org
- http://www.openwall.com/lists/oss-security/2011/07/11/1 Patch
- http://www.openwall.com/lists/oss-security/2011/07/12/14 Patch
- http://www.openwall.com/lists/oss-security/2011/07/20/1 Patch
- http://www.openwall.com/lists/oss-security/2011/07/20/16 Patch
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ Patch
- http://www.securityfocus.com/bid/49015 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=722415 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69032 exchange.xforce.ibmcloud.com