Описание
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 4 | ruby | Affected | ||
| Red Hat Enterprise Linux 5 | ruby | Affected | ||
| Red Hat Enterprise Linux 6 | ruby | Fixed | RHSA-2011:1581 | 05.12.2011 |
| Red Hat Hardened Images | ruby3-3-main-3.3.10-23.1.hum1 | Fixed | RHSA-2026:7305 | 09.04.2026 |
| Red Hat Hardened Images | ruby3-4-main-3.4.8-31.1.hum1 | Fixed | RHSA-2026:7307 | 09.04.2026 |
| Red Hat Hardened Images | ruby4-0-main-4.0.0-33.3.hum1 | Fixed | RHSA-2026:8838 | 17.04.2026 |
Показывать по
Дополнительная информация
Статус:
2.1 Low
CVSS2
Связанные уязвимости
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby ...
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
ELSA-2011-1581: ruby security, bug fix, and enhancement update (LOW)
2.1 Low
CVSS2