CVE-2011-2686 Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development. CVE-2011-2705 The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. CVE-2011-4815 Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Assignee: bugsquad => pterjan
No news ? see also bug 4000
CC: (none) => shikamaruSource RPM: (none) => ruby
Ping ?
ruby-1.8.7.p357-1.mga1 has been submitted to updates_testing, it contains fixes for those three CVE and for CVE-2011-0188 (from bug #4000) CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an integer truncation issue.
*** Bug 4000 has been marked as a duplicate of this bug. ***
CC: (none) => luigiwalser
Assigning to QA. Advisory: ======================== Updated ruby packages fix security vulnerabilities: CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an integer truncation issue. CVE-2011-2686 Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development. CVE-2011-2705 The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. CVE-2011-4815 Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2686 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2705 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4815 ======================== Updated packages in core/updates_testing: ======================== ruby-1.8.7.p357-1.mga1 ruby-doc-1.8.7.p357-1.mga1 ruby-devel-1.8.7.p357-1.mga1 ruby-tk-1.8.7.p357-1.mga1 from ruby-1.8.7.p357-1.mga1.src.rpm
CC: (none) => pterjanAssignee: pterjan => qa-bugs
Testing complete on i586 for the srpm ruby-1.8.7.p357-1.mga1.src.rpm No poc, so just testing that the program booh, which uses ruby works.
CC: (none) => davidwhodgins
Tested Ok with booh x86_64 Validating. Could sysadmin please push from core/updates_testing to core/updates See comment 5 for advisory and srpm. Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED