UpHeron
All vulnerabilities

Servers and applications

CVE-2011-2705

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

Severity
Medium 5.0
Published
5 Aug 2011
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Exploit chance
2.2% in the next 30 daysHigher than 83% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper input validation (CWE-20)
Attack
Over the network · No login needed
Attacker can
Read some data
CVSS vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • Version 1.9.2-p180
  • Version 1.9.2-p136
  • Version 1.9.2
  • Version 1.9.2-dev
All 34 release lines
  • Every version up to 1.8.7-334
  • Version 1.8.7-160
  • Version 1.8.7-173
  • Version 1.8.7-248
  • Version 1.8.7-249
  • Version 1.8.7-299
  • Version 1.8.7-302
  • Version 1.8.7-330
  • Version 1.8.7-p21
  • Version 1.8.7-p22
  • Version 1.8.7-p71
  • Version 1.8.7-p72
  • Version 1.9
  • Version 1.9.0-0
  • Version 1.9.0-1
  • Version 1.9.0-2
  • Version 1.9.0-20060415
  • Version 1.9.0-20070709
  • Version 1.9-r18423
  • Version 1.9.0-r18423
  • Version 1.9.1--preview_1
  • Version 1.9.1--preview_2
  • Version 1.9.1--rc1
  • Version 1.9.1--rc2
  • Version 1.9.1
  • Version 1.9.1--p0
  • Version 1.9.1--p129
  • Version 1.9.1--p243
  • Version 1.9.1--p376
  • Version 1.9.1--p429
  • Version 1.9.2-dev
  • Version 1.9.2
  • Version 1.9.2-p136
  • Version 1.9.2-p180

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-2705
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-2705