CVE-2011-2705 — Improper Input Validation in Ruby

CWE-20 — Improper Input Validation6 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
1.0%
top 23.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ruby-lang Ruby
Timeline
PublishedAug 5
Latest updateMay 17

Description

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDruby-lang/ruby1.8.7-334+20

Patches

Patch: lists.fedoraproject.org ↗Patch: svn.ruby-lang.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wj5x-c2v9-7wwr: The SecureRandom↗2022-05-17
▶
CVEList
CVE-2011-2705: The SecureRandom↗2011-08-05
▶

📋Vendor Advisories

2
Ubuntu
Ruby vulnerabilities↗2012-02-28
▶
Red Hat
ruby: Properly initialize the random number generator when forking new process↗2011-07-02
▶

💬Community

1
Bugzilla
CVE-2011-2686 CVE-2011-2705 CVE-2011-3009 ruby: Properly initialize the random number generator when forking new process↗2011-07-15
▶
CVE-2011-2705 — Improper Input Validation in Ruby | cvebase