CVE

Id
50921  
CVE No.
CVE-2011-3009  
Status
Candidate  
Description
Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.  
Phase
Assigned (20110805)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
549470 50921 CVE-2011-3009 MLIST:[oss-security] 20110720 Re: CVE Request: ruby PRNG fixes  View
549471 50921 CVE-2011-3009 URL:http://www.openwall.com/lists/oss-security/2011/07/20/1  View
549472 50921 CVE-2011-3009 MISC:http://redmine.ruby-lang.org/issues/show/4338  View
549473 50921 CVE-2011-3009 REDHAT:RHSA-2011:1581  View
549474 50921 CVE-2011-3009 URL:http://www.redhat.com/support/errata/RHSA-2011-1581.html  View
549475 50921 CVE-2011-3009 REDHAT:RHSA-2012:0070  View
549476 50921 CVE-2011-3009 URL:http://rhn.redhat.com/errata/RHSA-2012-0070.html  View
549477 50921 CVE-2011-3009 BID:49126  View
549478 50921 CVE-2011-3009 URL:http://www.securityfocus.com/bid/49126  View
549479 50921 CVE-2011-3009 XF:ruby-random-number-weak-security(69157)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
34607 JVNDB-2011-004849 Novell Data Synchronizer の WebAdmin における重要な情報を取得される脆弱性 Novell Data Synchronizer の Mobility Pack の WebAdmin は、HTTPS レスポンスのキャッシングを適切に制限しないため、重要な情報を取得される脆弱性が存在します。 CVE-2011-3014 50921 5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004849.html  View