Red Hat Security AdvisoryRHSA-2013:1136
rubygem-passenger security update
Released 2013-08-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHOSE Infrastructure 1.2 mod_passenger-3.0.21-3.el6op, ruby193-mod_passenger-3.0.21-3.el6op, ruby193-rubygem-passenger-3.0.21-3.el6op +13
- Red Hat OpenShift Enterprise Node mod_passenger-3.0.21-3.el6op, ruby193-mod_passenger-3.0.21-3.el6op, ruby193-rubygem-passenger-3.0.21-3.el6op +13
Fixes 2 records
Priority LOW 21
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory…
CVSS 2.0MEDIUM 4.6· Local · No auth · Interaction — · EPSS 0.00397 · Published 2014-01-02 · Fixed in 3.0.21, 4.0.5 CWE-264
Priority LOW 20
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a pre…
CVSS 2.0MEDIUM 4.4· Local · No auth · Interaction — · EPSS 0.00326 · Published 2013-09-30 · Fixed in 4.0.6 CWE-59
