Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Debian 8: DLA-1399-1 Moderate: Ruby-Passenger HTTP Exploits Fix

debian lts
Calendar Grey June 27, 2018
Dist Debian Esm H88
Recent vulnerabilities in ruby-passenger reveal risks of HTTP header spoofing and unauthorized privilege escalation, making immediate updates crucial for security.
Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation...
Topics%20covered

Topics Covered

security advisory moderate Debian http exploit ruby passenger

Summary

CVE-2018-12029
A vulnerability was discovered by the Pulse Security team. It was
exploitable only when running a non-standard
passenger_instance_registry_dir, via a race condition where after a
file was created, there was a window in which it could be replaced
with a symlink before it was chowned via the path and not the file
descriptor. If the symlink target was to a file which would be
executed by root such as root's crontab file, then privilege
escalation was possible. This is now mitigated by using fchown().

For Debian 8 "Jessie", these problems have been fixed in version
4.0.53-1+deb8u1.

We recommend that you upgrade your ruby-passenger packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Package: ruby-passenger
Version: 4.0.53-1+deb8u1
CVE ID: CVE-2015-7519 CVE-2018-12029
Debian Bug: 864651

Topics%20covered

Topics Covered

security advisory moderate Debian http exploit ruby passenger

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here