Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03Y3YzLWd2bWMtOG1xNc4AAUCS
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.
Permalink: https://github.com/advisories/GHSA-7cv3-gvmc-8mq5JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03Y3YzLWd2bWMtOG1xNc4AAUCS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 10 months ago
CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-7cv3-gvmc-8mq5, CVE-2018-12026
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-12026
- https://blog.phusion.nl/passenger-5-3-2
- https://security.gentoo.org/glsa/201807-02
- https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12026.yml
- https://github.com/phusion/passenger/commit/fd3717a3cd357aa0e80e1e81d4dc94a1eaf928f1
- https://github.com/advisories/GHSA-7cv3-gvmc-8mq5
Blast Radius: 34.5
Affected Packages
rubygems:passenger
Dependent packages: 24Dependent repositories: 3,332
Downloads: 26,906,943 total
Affected Version Ranges: >= 5.3.0, < 5.3.2
Fixed in: 5.3.2
All affected versions: 5.3.0, 5.3.1
All unaffected versions: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.1.2, 2.1.3, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.17, 3.0.18, 3.0.19, 3.0.21, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.10, 4.0.13, 4.0.14, 4.0.16, 4.0.17, 4.0.18, 4.0.19, 4.0.20, 4.0.21, 4.0.23, 4.0.24, 4.0.25, 4.0.26, 4.0.27, 4.0.28, 4.0.29, 4.0.30, 4.0.31, 4.0.32, 4.0.33, 4.0.34, 4.0.35, 4.0.36, 4.0.37, 4.0.38, 4.0.39, 4.0.40, 4.0.41, 4.0.42, 4.0.43, 4.0.44, 4.0.45, 4.0.46, 4.0.48, 4.0.49, 4.0.50, 4.0.51, 4.0.52, 4.0.53, 4.0.55, 4.0.56, 4.0.57, 4.0.58, 4.0.59, 4.0.60, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18, 5.0.19, 5.0.20, 5.0.21, 5.0.22, 5.0.23, 5.0.24, 5.0.25, 5.0.26, 5.0.27, 5.0.28, 5.0.29, 5.0.30, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.0.16, 6.0.17, 6.0.18, 6.0.19, 6.0.20