Description
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.352-3.el6 | RHSA-2011:1581 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby3.3 +5 | 3.3.10-23.1.hum1 | RHSA-2026:7305 |
| Red Hat Hardened Images 1 | ruby3.4 +5 | 3.4.8-31.1.hum1 | RHSA-2026:7307 |
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.0-33.3.hum1 | RHSA-2026:8838 |
Advisories 6
- RHSA-2026:7305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:8838 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:7307 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2011:1581 Red Hat Security Advisory: ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-88-1 ruby1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-235-1 ruby1.9.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110712 Re: CVE Request: ruby PRNG fixes mailing-list
- http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/
- https://bugzilla.redhat.com/show_bug.cgi?id=722415
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list
- RHSA-2011:1581 vendor-advisory
- http://www.ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released/
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050
- http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog
- FEDORA-2011-9374 vendor-advisory
- http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list
- http://redmine.ruby-lang.org/issues/4579
- [oss-security] 20110711 CVE Request: ruby PRNG fixes mailing-list
- 49015 vdb-entry
- FEDORA-2011-9359 vendor-advisory