NVD

Id
9442  
Name
CVE-2011-2705  
Description
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2011-08-05  
Modified Date
2012-01-18  
Seq
2011-2705  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
53926 9442 CVE-2011-2705 FEDORA-2011-9374  View
53927 9442 CVE-2011-2705 FEDORA-2011-9359  View
53928 9442 CVE-2011-2705 http://redmine.ruby-lang.org/issues/4579  View
53929 9442 CVE-2011-2705 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050  View
53930 9442 CVE-2011-2705 http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog  View
53931 9442 CVE-2011-2705 http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog  View
53932 9442 CVE-2011-2705 [oss-security] 20110711 CVE Request: ruby PRNG fixes  View
53933 9442 CVE-2011-2705 [oss-security] 20110712 Re: CVE Request: ruby PRNG fixes  View
53934 9442 CVE-2011-2705 [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes  View
53935 9442 CVE-2011-2705 [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes  View
53936 9442 CVE-2011-2705 RHSA-2011:1581  View
53937 9442 CVE-2011-2705 http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/  View
53938 9442 CVE-2011-2705 http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/  View
53939 9442 CVE-2011-2705 49015  View
53940 9442 CVE-2011-2705 https://bugzilla.redhat.com/show_bug.cgi?id=722415  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34544 JVNDB-2011-004786 Ruby の SecureRandom.random_bytes 関数における結果の文字列を推測される脆弱性 lib/securerandom.rb in Ruby の lib/securerandom.rb の SecureRandom.random_bytes 関数は、初期化に際して PID 値に依存しているため、結果の文字列を推測される脆弱性が存在します。 CVE-2011-2705 50612 CVE-2011-2705 9442 5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004786.html 2011-08-05 2012-03-27 View