GHSA-C7J7-P5JQ-26FF Insecure use of temporary files in passenger

🗓️ 10 Oct 2018 17:29:20Reported by GoogleType

osv🔗 osv.dev👁 18 Views

Insecure use of temporary files in passenger. Local users can write to certain files and directories via symlink attack on control_process.pid or generation-* file.

Reporter	Title	Published	Views	Family All 19
CNVD	Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01246)	21 Feb 201500:00	–	cnvd
CVE	CVE-2014-1831	19 Feb 201515:00	–	cve
Cvelist	CVE-2014-1831	19 Feb 201515:00	–	cvelist
Debian CVE	CVE-2014-1831	19 Feb 201515:00	–	debiancve
EUVD	EUVD-2018-0570	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 20 Update: rubygem-passenger-4.0.53-3.fc20	3 Feb 201512:03	–	fedora
Tenable Nessus	Fedora 20 : rubygem-passenger-4.0.53-3.fc20 (2015-1151)	4 Feb 201500:00	–	nessus
Github Security Blog	Insecure use of temporary files in passenger	10 Oct 201817:29	–	github
NVD	CVE-2014-1831	19 Feb 201515:59	–	nvd
OpenVAS	Fedora Update for rubygem-passenger FEDORA-2015-1151	4 Feb 201500:00	–	openvas

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-1831
github	www.github.com/phusion/passenger/commit/34b1087870c2
bugs	www.bugs.debian.org/cgi-bin/bugreport.cgi
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/advisories/GHSA-c7j7-p5jq-26ff
github	www.github.com/phusion/passenger
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2014-1831.yml
lists	www.lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html
openwall	www.openwall.com/lists/oss-security/2014/01/28/8
openwall	www.openwall.com/lists/oss-security/2014/01/30/3

08 Dec 2024 05:43Current

5.8Medium risk

Vulners AI Score5.8

CVSS 22.1

EPSS0.00371