Phusion Passenger Denial of Service

2017-10-2418:33:37

Google

osv.dev

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary “config” file in a directory with a predictable name in /tmp/ before it is used by the gem.

CPENameOperatorVersion
passengereq2.1.2
passengereq2.0.3
passengereq2.2.14
passengereq2.2.5
passengereq3.0.9
passengereq3.0.10
passengereq1.0.1
passengereq3.0.15
passengereq3.0.0.pre2
passengereq1.0.5

Name	Operator	Version
passenger	eq	2.1.2
passenger	eq	2.0.3
passenger	eq	2.2.14
passenger	eq	2.2.5
passenger	eq	3.0.9
passenger	eq	3.0.10
passenger	eq	1.0.1
passenger	eq	3.0.15
passenger	eq	3.0.0.pre2
passenger	eq	1.0.5