CVE-2011-2705

CVE-2011-2705 describes a weakness in the SecureRandom.random_bytes function within Ruby versions before 1.8.7-p352 and 1.9.x before 1.9.2-p290. This vulnerability arises because the function's initialization relies on predictable Process ID (PID) values, making it easier for attackers to guess subsequent "random" strings if they know a previous one generated by the same process. The vulnerability has a CVSS score of 5.0 (Medium), indicating a network-based attack with low complexity, requiring no authentication, and primarily impacting confidentiality by allowing information disclosure. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 17/100. There is no evidence of active exploitation, nor are there known Metasploit modules, Nuclei templates, or ExploitDB entries. Community discussion and media coverage are minimal, suggesting a lack of widespread attention or exploitation.