369 matches found
Design/Logic Flaw
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...
CVE-2015-7519
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...
CVE-2015-7519
Summary (validated by connected docs): CVE-2015-7519 affects Phusion Passenger in Apache integration or standalone mode without a filtering proxy, where the module’s HTTP header handling in agent/Core/Controller/SendRequest.cpp allows remote attackers to spoof headers by replacing a dash with an ...
CVE-2015-7519
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...
SUSE-SU-2016:0042-1 Security update for rubygem-passenger
This update fixes the following security issues: - CVE-2015-7519: Passenger is not filtering environment like apache is doing bnc956281 - CVE-2013-4136: Fixed security issue Passenger would reuse existing server instance directories temporary directories which could cause Passenger to remove or...
SUSE-SU-2015:2337-1 Security update for rubygem-passenger
This update for rubygem-passenger fixes the following issues: - CVE-2015-7519: rubygem-passenger was not filtering the environment like apache is doing, allowing injection of environment variables bsc956281...
FreeBSD : passenger -- client controlled header overwriting (84fdd1bb-9d37-11e5-8f5c-002590263bf5)
"Daniel Knoppel reports : It was discovered by the SUSE security team that it was possible, in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue. CVE-2015-7519 has been assigned to this issue. Affected use-cases : Header overwriting may occ...
Phusion Passenger Server allows to overwrite headers in some cases
It is possible in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue. Passenger 5 uses an SCGI-inspired format to pass headers to Ruby/Python applications, while Passenger 4 uses an SCGI-inspired format to pass headers to all applications...
United Airlines Hacked by Sophisticated Hacking Group
A group of China-backed hackers believed to be responsible for high-profile data breaches, including the U.S. Office of Personnel Management and the insurance giant Anthem, has now hit another high-profile target – United Airlines. United detected a cyber attack into its computer systems in May o...
Government Report Critical of FAA Security Controls
The Federal Aviation Administration has been put on notice that its information security controls are not up to par and that a risk-based program must be implemented from the ground up in order to assure the safety of its networks and passengers in the sky. A scathing Government Accounting Office...
Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01246)
Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Versions of Phusion Passenger prior to 4.0.37 have a symbolic link attack vulnerability due to the program not creating temporary files in a secure...
Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01260)
Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Phusion Passenger 4.0.37 suffers from a symbolic link attack vulnerability due to the program not creating temporary files in a secure manner. An...
CVE-2014-1832
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...
CVE-2014-1831
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file...
CVE-2014-1831
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file...
DEBIAN-CVE-2014-1831
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file...
Arbitrary file deletion
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file...
CVE-2014-1832
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...