Read the docs
TI-2011-02366 Aliases CVE-2011-2705GHSA-wj5x-c2v9-7wwr

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352…

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 9 fixed, 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

Why it matters now

EPSS 0.02248 82nd percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 9 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*up to 1.8.7-334Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:*1.8.7 p22Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p71:*:*:*:*:*:*1.8.7 p71Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7:p72:*:*:*:*:*:*1.8.7 p72Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-160:*:*:*:*:*:*:*1.8.7-160Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-173:*:*:*:*:*:*:*1.8.7-173Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-248:*:*:*:*:*:*:*1.8.7-248Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-249:*:*:*:*:*:*:*1.8.7-249Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-299:*:*:*:*:*:*:*1.8.7-299Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-302:*:*:*:*:*:*:*1.8.7-302Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions up to 1.8.7-334 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:* Versions 1.8.7 p22 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p71:*:*:*:*:*:* Versions 1.8.7 p71 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7:p72:*:*:*:*:*:* Versions 1.8.7 p72 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-160:*:*:*:*:*:*:* Versions 1.8.7-160 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-173:*:*:*:*:*:*:* Versions 1.8.7-173 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-248:*:*:*:*:*:*:* Versions 1.8.7-248 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-249:*:*:*:*:*:*:* Versions 1.8.7-249 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-299:*:*:*:*:*:*:* Versions 1.8.7-299 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-302:*:*:*:*:*:*:* Versions 1.8.7-302 Vulnerable ·ruby
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:1.8.7-330:*:*:*:*:*:*:*1.8.7-330Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.8.7-p21:*:*:*:*:*:*:*1.8.7-p21Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*1.9Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9:r18423:*:*:*:*:*:*1.9 r18423Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0:*:*:*:*:*:*:*1.9.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423:*:*:*:*:*:*1.9.0 r18423Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-0:*:*:*:*:*:*:*1.9.0-0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-1:*:*:*:*:*:*:*1.9.0-1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-2:*:*:*:*:*:*:*1.9.0-2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:*:*:*:*:*:*:*1.9.0-20060415Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:*:*:*:*:*:*:*1.9.0-20070709Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*1.9.1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:*1.9.1 -p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:*1.9.1 -p129Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:*1.9.1 -p243Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376:*:*:*:*:*:*1.9.1 -p376Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429:*:*:*:*:*:*1.9.1 -p429Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:*1.9.1 -preview_1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:*1.9.1 -preview_2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:*1.9.1 -rc1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:*1.9.1 -rc2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*1.9.2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2:dev:*:*:*:*:*:*1.9.2 devVulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2-p136:*:*:*:*:*:*:*1.9.2-p136Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2-p180:*:*:*:*:*:*:*1.9.2-p180Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-330:*:*:*:*:*:*:* Versions 1.8.7-330 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.8.7-p21:*:*:*:*:*:*:* Versions 1.8.7-p21 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9:r18423:*:*:*:*:*:* Versions 1.9 r18423 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423:*:*:*:*:*:* Versions 1.9.0 r18423 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-0:*:*:*:*:*:*:* Versions 1.9.0-0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-1:*:*:*:*:*:*:* Versions 1.9.0-1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-2:*:*:*:*:*:*:* Versions 1.9.0-2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:*:*:*:*:*:*:* Versions 1.9.0-20060415 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:*:*:*:*:*:*:* Versions 1.9.0-20070709 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:* Versions 1.9.1 -p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:* Versions 1.9.1 -p129 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:* Versions 1.9.1 -p243 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376:*:*:*:*:*:* Versions 1.9.1 -p376 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429:*:*:*:*:*:* Versions 1.9.1 -p429 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:* Versions 1.9.1 -preview_1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:* Versions 1.9.1 -preview_2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:* Versions 1.9.1 -rc1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:* Versions 1.9.1 -rc2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2:dev:*:*:*:*:*:* Versions 1.9.2 dev Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2-p136:*:*:*:*:*:*:* Versions 1.9.2-p136 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2-p180:*:*:*:*:*:*:* Versions 1.9.2-p180 Vulnerable ·ruby

Remediation

Red Hat 4 advisories

  • RHSA-2026:8838 Released 2026-04-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
  • RHSA-2026:7307 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
  • RHSA-2026:7305 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 1 more Red Hat advisories
  • RHSA-2011:1581 Released 2011-12-05 · Red Hat rating Low
    ruby security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) ruby-1.8.7.352-3.el6, ruby-irb-1.8.7.352-3.el6, ruby-libs-1.8.7.352-3.el6
    • Red Hat Enterprise Linux Desktop Optional (v. 6) ruby-1.8.7.352-3.el6, ruby-devel-1.8.7.352-3.el6, ruby-docs-1.8.7.352-3.el6 +4
    • Red Hat Enterprise Linux HPC Node (v. 6) ruby-1.8.7.352-3.el6, ruby-irb-1.8.7.352-3.el6, ruby-libs-1.8.7.352-3.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) ruby-1.8.7.352-3.el6, ruby-devel-1.8.7.352-3.el6, ruby-docs-1.8.7.352-3.el6 +4
    • Red Hat Enterprise Linux Server (v. 6) ruby-1.8.7.352-3.el6, ruby-irb-1.8.7.352-3.el6, ruby-libs-1.8.7.352-3.el6 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) ruby-1.8.7.352-3.el6, ruby-devel-1.8.7.352-3.el6, ruby-devel-1.8.7.352-3.el6.ppc +5
    • Red Hat Enterprise Linux Workstation (v. 6) ruby-1.8.7.352-3.el6, ruby-irb-1.8.7.352-3.el6, ruby-libs-1.8.7.352-3.el6
    • Red Hat Enterprise Linux Workstation Optional (v. 6) ruby-1.8.7.352-3.el6, ruby-devel-1.8.7.352-3.el6, ruby-docs-1.8.7.352-3.el6 +4

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix yet
Red Hat Enterprise Linux 5AffectedNo fix yet
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:1581
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:1581
Red Hat Hardened ImagesFixed RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-2705
  2. 2026-10-03 Alias added: GHSA-wj5x-c2v9-7wwr
  3. 2026-11-06 Affected versions changed · Red Hat

References

Patch 9

Advisory 2

Other 3

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
  • TI-2018-11751 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5… CVSS 3.0CRITICAL 9.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences