CVE-2011-4121: OpenSSL OpenSSL extension of Ruby (Git trunk)…

CVE-2011-4121: The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an ex...

The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 7, 2024, 00:01 UTC (UTC+00:00)

Security readout for executives and security teams

This flaw affected Ruby's OpenSSL extension in Git trunk builds during a narrow 2011 window. RSA keys generated there could be fundamentally weak, undermining services that relied on those keys for trust or integrity. Evidence points to a development trunk issue, not broad OpenSSL library exposure. Likely limited to organizations that built Ruby from Git trunk during the affected dates and used it to generate RSA private keys. Standard packaged releases are not identified in the supplied evidence. Treat as targeted cleanup unless evidence shows affected keys remain trusted. Business urgency rises sharply if production certificates, signing keys, or authentication keys trace to the affected Ruby trunk builds. Mitigation focus: Check vendor and Ruby project guidance for the affected trunk range.; Replace any affected Ruby Git trunk build still present.; Rotate RSA keys generated by affected builds during the window..

Prepared: Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2011-4121 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Nov 26, 2019, 04:35 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
https://security-tracker.debian.org/tracker/CVE-2011-4121CVE reference · x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4121CVE reference · x_refsource_MISC
https://access.redhat.com/security/cve/cve-2011-4121CVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

OpenSSLOpenSSL extension of Ruby (Git trunk)versions after 2011-09-01 up to 2011-11-03Listed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.