| Package | Affected versions | Patched versions |
|---|---|---|
| ruby | = 1.8.7= 1.8.7-160= 1.8.7-173= 1.8.7-248= 1.8.7-249= 1.8.7-299= 1.8.7-302= 1.8.7-330= 1.8.7-p21= 1.9= 1.9.0= 1.9.0-0= 1.9.0-1= 1.9.0-2= 1.9.0-20060415= 1.9.0-20070709= 1.9.1= 1.9.2= 1.9.2-p136= 1.9.2-p180≤ 1.8.7-334 |
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free