DebianDEBIAN:DLA-394-1:100B0[SECURITY] [DLA 394-1] passenger security update
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.4 Medium
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.8%
Package : passenger
Version : 2.2.11debian-2+deb6u1
CVE ID : CVE-2015-7519
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60
and 5.0.x before 5.0.22, when used in Apache integration mode or in
standalone mode without a filtering proxy, allows remote attackers to
spoof headers passed to applications by using an _ (underscore) character
instead of a - (dash) character in an HTTP header, as demonstrated by an
X_User header.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 8 | amd64 | ruby-passenger | < 4.0.53-1+deb8u1 | ruby-passenger_4.0.53-1+deb8u1_amd64.deb |
| Debian | 6 | all | passenger | < 2.2.11debian-2+deb6u1 | passenger_2.2.11debian-2+deb6u1_all.deb |
| Debian | 6 | i386 | libapache2-mod-passenger | < 2.2.11debian-2+deb6u1 | libapache2-mod-passenger_2.2.11debian-2+deb6u1_i386.deb |
| Debian | 6 | amd64 | libapache2-mod-passenger | < 2.2.11debian-2+deb6u1 | libapache2-mod-passenger_2.2.11debian-2+deb6u1_amd64.deb |
| Debian | 8 | armel | ruby-passenger | < 4.0.53-1+deb8u1 | ruby-passenger_4.0.53-1+deb8u1_armel.deb |
| Debian | 6 | all | passenger-doc | < 2.2.11debian-2+deb6u1 | passenger-doc_2.2.11debian-2+deb6u1_all.deb |
| Debian | 8 | all | ruby-passenger | < 4.0.53-1+deb8u1 | ruby-passenger_4.0.53-1+deb8u1_all.deb |
| Debian | 8 | armel | libapache2-mod-passenger | < 4.0.53-1+deb8u1 | libapache2-mod-passenger_4.0.53-1+deb8u1_armel.deb |
| Debian | 8 | armhf | libapache2-mod-passenger | < 4.0.53-1+deb8u1 | libapache2-mod-passenger_4.0.53-1+deb8u1_armhf.deb |
| Debian | 8 | i386 | ruby-passenger | < 4.0.53-1+deb8u1 | ruby-passenger_4.0.53-1+deb8u1_i386.deb |
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.4 Medium
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.8%