CVE-2011-2686 Weak cryptography in n/a
Attackers can predict random numbers in forked Ruby processes due to improper seed resetting, potentially compromising cryptographic operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-2686?
CVE-2011-2686 is a medium-severity vulnerability in Ruby-Lang Ruby, published on 5 Aug 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Weakness: CWE-310
Which versions are affected by CVE-2011-2686?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2011-2686?
Upgrade to a fixed version.
Is CVE-2011-2686 being exploited?
There is no known exploitation of CVE-2011-2686 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as GHSA-g8g6-3p4h-6388.