CVE-2011-2686

MEDIUM 5.0CVE-2011-2686 · Published 05/08/2011 · updated 16/06/2026

In short

CVE-2011-2686 is a MEDIUM (CVSS 5.0) vulnerability affecting ruby (ruby-lang).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ruby ruby-lang	`= 1.8.7= 1.8.7-160= 1.8.7-173= 1.8.7-248= 1.8.7-249= 1.8.7-299= 1.8.7-302= 1.8.7-330= 1.8.7-p21≤ 1.8.7-334`	No fix yet

Description

Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.

References

More vulnerabilities in ruby

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free