Description
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.openwall.com/lists/oss-security/2011/07/12/14 ↗
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=722415 ↗
- http://www.openwall.com/lists/oss-security/2011/07/20/16 ↗
- http://www.redhat.com/support/errata/RHSA-2011-1581.html ↗
- http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/ ↗
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 ↗
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html ↗
- http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog ↗
- http://www.openwall.com/lists/oss-security/2011/07/20/1 ↗
- http://redmine.ruby-lang.org/issues/4579 ↗
- http://www.openwall.com/lists/oss-security/2011/07/11/1 ↗
- http://www.securityfocus.com/bid/49015 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html ↗