Description
Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.352-3.el6 | RHSA-2011:1581 |
| RHEL 5 | ruby +8 | 1.8.5-22.el5_7.1 | RHSA-2012:0070 |
| RHEL 4 | irb +6 | 1.8.1-18.el4 | RHSA-2012:0070 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby3.3 +5 | 3.3.10-23.1.hum1 | RHSA-2026:7305 |
| Red Hat Hardened Images 1 | ruby3.4 +5 | 3.4.8-31.1.hum1 | RHSA-2026:7307 |
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.0-33.3.hum1 | RHSA-2026:8838 |
Advisories 5
- RHSA-2026:7305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:8838 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:7307 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2012:0070 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1581 Red Hat Security Advisory: ruby security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 49126 vdb-entry
- RHSA-2011:1581 vendor-advisory
- ruby-random-number-weak-security(69157) vdb-entry
- RHSA-2012:0070 vendor-advisory
- http://redmine.ruby-lang.org/issues/show/4338
- [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes mailing-list