The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby prior to 1.8.7-p352 and 1.9.x prior to 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent malicious users to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
ruby-lang ruby 1.8.7 |
||
ruby-lang ruby |
||
ruby-lang ruby 1.8.7-p21 |
||
ruby-lang ruby 1.8.7-173 |
||
ruby-lang ruby 1.8.7-160 |
||
ruby-lang ruby 1.8.7-330 |
||
ruby-lang ruby 1.8.7-249 |
||
ruby-lang ruby 1.8.7-248 |
||
ruby-lang ruby 1.8.7-302 |
||
ruby-lang ruby 1.8.7-299 |
||
ruby-lang ruby 1.9.1 |
||
ruby-lang ruby 1.9.0 |
||
ruby-lang ruby 1.9.0-2 |
||
ruby-lang ruby 1.9.0-20070709 |
||
ruby-lang ruby 1.9.0-1 |
||
ruby-lang ruby 1.9.2 |
||
ruby-lang ruby 1.9.2-p180 |
||
ruby-lang ruby 1.9 |
||
ruby-lang ruby 1.9.0-0 |
||
ruby-lang ruby 1.9.2-p136 |
||
ruby-lang ruby 1.9.0-20060415 |