Description
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | ruby1.8 | 1.8.7.302-2squeeze3 | DLA-88-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby3.3 +5 | 3.3.10-23.1.hum1 | RHSA-2026:7305 |
| Red Hat Hardened Images 1 | ruby3.4 +5 | 3.4.8-31.1.hum1 | RHSA-2026:7307 |
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.0-33.3.hum1 | RHSA-2026:8838 |
Advisories 4
- RHSA-2026:7305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:8838 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:7307 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- DLA-88-1 ruby1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110712 Re: CVE Request: ruby PRNG fixes mailing-list
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/
- https://bugzilla.redhat.com/show_bug.cgi?id=722415
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list
- http://redmine.ruby-lang.org/issues/show/4338
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713
- FEDORA-2011-9374 vendor-advisory
- ruby-random-number-dos(69032) vdb-entry
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list
- [oss-security] 20110711 CVE Request: ruby PRNG fixes mailing-list
- 49015 vdb-entry
- FEDORA-2011-9359 vendor-advisory