DebianDEBIAN:DLA-1399-1:69ED4[SECURITY] [DLA 1399-1] ruby-passenger security update
4.4 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
Low
0.007 Low
EPSS
Percentile
80.8%
Package : ruby-passenger
Version : 4.0.53-1+deb8u1
CVE ID : CVE-2015-7519 CVE-2018-12029
Debian Bug : 864651
Two flaws were discovered in ruby-passenger for Ruby Rails and Rack
support that allowed attackers to spoof HTTP headers or exploit a race
condition which made privilege escalation under certain conditions
possible.
CVE-2015-7519
Remote attackers could spoof headers passed to applications by using
an underscore character instead of a dash character in an HTTP
header as demonstrated by an X_User header.
CVE-2018-12029
A vulnerability was discovered by the Pulse Security team. It was
exploitable only when running a non-standard
passenger_instance_registry_dir, via a race condition where after a
file was created, there was a window in which it could be replaced
with a symlink before it was chowned via the path and not the file
descriptor. If the symlink target was to a file which would be
executed by root such as root's crontab file, then privilege
escalation was possible. This is now mitigated by using fchown().
For Debian 8 "Jessie", these problems have been fixed in version
4.0.53-1+deb8u1.
We recommend that you upgrade your ruby-passenger packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 9 | arm64 | libapache2-mod-passenger | < 5.0.30-1+deb9u1 | libapache2-mod-passenger_5.0.30-1+deb9u1_arm64.deb |
| Debian | 9 | mipsel | passenger | < 5.0.30-1+deb9u1 | passenger_5.0.30-1+deb9u1_mipsel.deb |
| Debian | 9 | armhf | libapache2-mod-passenger | < 5.0.30-1+deb9u1 | libapache2-mod-passenger_5.0.30-1+deb9u1_armhf.deb |
| Debian | 9 | mips | passenger | < 5.0.30-1+deb9u1 | passenger_5.0.30-1+deb9u1_mips.deb |
| Debian | 9 | arm64 | passenger-dbgsym | < 5.0.30-1+deb9u1 | passenger-dbgsym_5.0.30-1+deb9u1_arm64.deb |
| Debian | 9 | mips64el | passenger | < 5.0.30-1+deb9u1 | passenger_5.0.30-1+deb9u1_mips64el.deb |
| Debian | 8 | armel | libapache2-mod-passenger | < 4.0.53-1+deb8u1 | libapache2-mod-passenger_4.0.53-1+deb8u1_armel.deb |
| Debian | 8 | i386 | ruby-passenger | < 4.0.53-1+deb8u1 | ruby-passenger_4.0.53-1+deb8u1_i386.deb |
| Debian | 9 | arm64 | passenger | < 5.0.30-1+deb9u1 | passenger_5.0.30-1+deb9u1_arm64.deb |
| Debian | 9 | i386 | libapache2-mod-passenger-dbgsym | < 5.0.30-1+deb9u1 | libapache2-mod-passenger-dbgsym_5.0.30-1+deb9u1_i386.deb |
Related
4.4 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
7 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
6.4 Medium
AI Score
Confidence
Low
0.007 Low
EPSS
Percentile
80.8%