CVE-2011-2705
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x...
5.0 MediumFix available
CVE-2011-2705 is a medium vulnerability (CVSS 5.0) in Ruby-lang Ruby, published August 5, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 82nd percentile. Fixed in ruby1.9.1 1.9.2.0-2+deb6u4.
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Exploit likelihood
2.25%Down 0.4 points since Feb 4, 2022
What each source reports
NVD Score used
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
- Record
CVE-2011-2705- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
- Record
CVE-2011-2705- Updated
- 2026-11-02
EUVDEUVD-2011-2686 No score
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
- Record
EUVD-2011-2686- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wj5x-c2v9-7wwr No score
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x...
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
- Record
GHSA-wj5x-c2v9-7wwr- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2026:7305
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:7307
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:8838
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:8838- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ruby1.9.1Debian:6.0 |
before 1.9.2.0-2+deb6u4, plus listed versions 1.9.2.0-21.9.2.0-2+armhf |
1.9.2.0-2+deb6u4 |
ruby1.8Debian:6.0 |
before 1.8.7.302-2squeeze3, plus listed versions 1.8.7.302-21.8.7.302-2squeeze11.8.7.302-2squeeze2 |
1.8.7.302-2squeeze3 |
rubyRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-develRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-docsRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-rdocRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-riRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-staticRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-tcltkRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
Show 50 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-irbRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-libsRed Hat:enterprise_linux:6::client |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
rubyRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-develRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-docsRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-rdocRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-riRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-staticRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-tcltkRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-irbRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-libsRed Hat:enterprise_linux:6::computenode |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
rubyRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-develRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-docsRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-rdocRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-riRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-staticRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-tcltkRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-irbRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-libsRed Hat:enterprise_linux:6::server |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
rubyRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-develRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-docsRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-rdocRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-riRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-staticRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-tcltkRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-irbRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby-libsRed Hat:enterprise_linux:6::workstation |
before 0:1.8.7.352-3.el6 | 0:1.8.7.352-3.el6 |
ruby3.3Red Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-bundled-gemsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-default-gemsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-develRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-docRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.3-libsRed Hat:hummingbird:1 |
before 0:3.3.10-23.1.hum1 | 0:3.3.10-23.1.hum1 |
ruby3.4Red Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-bundled-gemsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-default-gemsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-develRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-docRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby3.4-libsRed Hat:hummingbird:1 |
before 0:3.4.8-31.1.hum1 | 0:3.4.8-31.1.hum1 |
ruby4.0Red Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-bundled-gemsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-default-gemsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-develRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-docRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
ruby4.0-libsRed Hat:hummingbird:1 |
before 0:4.0.0-33.3.hum1 | 0:4.0.0-33.3.hum1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2011/07/12/14
ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released
bugzilla.redhat.com/show_bug.cgi?id=722415
redhat.com/support/errata/RHSA-2011-1581.html
Show 180 moreShow less
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050
lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html
redmine.ruby-lang.org/issues/4579
securityfocus.com/bid/49015
nvd.nist.gov/vuln/detail/CVE-2011-2705
github.com/advisories/GHSA-wj5x-c2v9-7wwr
access.redhat.com/errata/RHSA-2011:1581
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1581.json
cve.org/CVERecord?id=CVE-2011-2705
images.redhat.com
hackerone.com/reports/3467067