CVE-2011-2705: Input Validation
The SecureRandom.randombytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2705?
CVE-2011-2705 is considered to have moderate severity due to its impact on the predictability of random number generation in Ruby.
How do I fix CVE-2011-2705?
To fix CVE-2011-2705, upgrade to Ruby version 1.8.7-p352 or later, or 1.9.2-p290 or later.
What are the affected versions by CVE-2011-2705?
CVE-2011-2705 affects Ruby versions before 1.8.7-p352 and all 1.9.x versions prior to 1.9.2-p290.
What type of vulnerability is CVE-2011-2705?
CVE-2011-2705 is a vulnerability related to insufficient randomness in cryptographic functions.
Who can be affected by CVE-2011-2705?
Context-dependent attackers who can predict random strings generated by vulnerable Ruby versions can be affected by CVE-2011-2705.