Read the docs
TI-2011-03639 Aliases CVE-2011-4121GHSA-mjg4-5rfj-952f

The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03…

Priority MEDIUM 47CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-326.

Summary

The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.

Why it matters now

EPSS 0.02529 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL extension of Ruby (Git trunk)versions after 2011-09-01 up to 2011-11-03—No fix listedCNA
  • OpenSSL extension of Ruby (Git trunk) VendorOpenSSL Affected versions after 2011-09-01 up to 2011-11-03 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*1.8.7.334 to before 1.9.3Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions 1.8.7.334 to before 1.9.3 Vulnerable ·ruby

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-4121
  2. 2026-10-03 Alias added: GHSA-mjg4-5rfj-952f

References

Advisory 4

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 323 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences