Vulnerability in Ruby-Lang Ruby

CVE-2011-2686

Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.026 (83.6th percentile) — read the EPSS interpretation.