Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

SUSE: 2018:2039-1 Moderate: rubygem-passenger Local Escalation Fix

suse
Calendar Grey July 23, 2018
Scroller Suse
Important SUSE patch for rubygem-passenger resolves file system access vulnerability enabling local privilege escalation.
An update that fixes one vulnerability is now available

Summary

This update for rubygem-passenger fixes the following issue: The following security vulnerability was addressed: - CVE-2018-12029: Fixed a file system access race condition in the chown command, which allowed for local privilege escalation and affects the Nginx module (bsc#1097663). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Containers 12: zypper in -t patch SUSE-SLE-Module-Containers-12-2018-1373=1 Package List: - SUSE Linux Enterprise Module for Containers 12 (x86_64): ruby2.1-rubygem-passenger-5.0.18-12.9.1 ruby2.1-rubygem-passenger-debuginfo-5.0.18-12.9.1

Topics%20covered

Topics Covered

security advisory moderate severity local escalation SUSE Linux rubygem-passenger

References

#1097663

Cross- CVE-2018-12029

Affected Products:

SUSE Linux Enterprise Module for Containers 12

https://www.suse.com/security/cve/CVE-2018-12029.html

https://bugzilla.suse.com/1097663

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:2039-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate severity local escalation SUSE Linux rubygem-passenger

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.