Lucene search

RubySecRUBY:RUBY-2011-2705

HistoryJul 01, 2011 - 8:00 p.m.

Ruby Random Number Generation Local Denial Of Service Vulnerability

2011-07-0120:00:00

RubySec

redmine.ruby-lang.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before
1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for
initialization, which makes it easier for context-dependent attackers to
predict the result string by leveraging knowledge of random strings obtained
in an earlier process with the same PID.

Affected configurations

Vulners

Node

rubyrubyRange1.8.0–1.8.7.352

rubyrubyRange≤1.9.2.290

VendorProductVersionCPE
rubyruby*cpe:2.3:a:ruby:ruby:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruby	ruby	*	cpe:2.3:a:ruby:ruby::::::::

References

redmine.ruby-lang.org/issues/4579

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Related for RUBY:RUBY-2011-2705