CVE-2018-12615

An issue was discovered in switchGroup in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups gidset is not set correctly, leaving it up to randomness i.e., uninitialized memory which supplementary groups are actually being set while lowering privileges...

CVE-2018-12615

Phusion Passenger (before 5.3.2) is affected by CVE-2018-12615. The issue is in switchGroup() (agent/ExecHelper/ExecHelperMain.cpp): the gidset controlling supplementary groups is not set correctly, leaving it up to randomness (uninitialized memory) to determine which groups are actually applied ...