CVE-2011-2686
ruby-lang ruby: no CVSS score yet. EPSS 2.6% chance of exploitation in the next 30 days.
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-11-01)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ruby-lang:ruby
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html
- http://redmine.ruby-lang.org/issues/show/4338
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog