CVE-2013-2119
Fixed in a distro release EPSS <1%
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Products: phusion passenger, redhat openshift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | passenger | 3.0.21 |
| RubyGems | passenger | 4.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 1.2 | mod_passenger | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-mod_passenger | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger-debuginfo | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger-devel | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger-doc | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger-native | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | ruby193-rubygem-passenger-native-libs | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-file-tail | 0:1.0.5-4.el6op |
| Red Hat openshift 1.2 | rubygem-file-tail-doc | 0:1.0.5-4.el6op |
| Red Hat openshift 1.2 | rubygem-passenger | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-passenger-debuginfo | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-passenger-devel | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-passenger-doc | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-passenger-native | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-passenger-native-libs | 0:3.0.21-3.el6op |
| Red Hat openshift 1.2 | rubygem-spruz | 0:0.2.5-4.el6op |
| Red Hat openshift 1.2 | rubygem-spruz-doc | 0:0.2.5-4.el6op |
| SUSE Lifecycle Management Server 1.3 | rubygem-passenger | 3.0.14-0.14.1 |
| SUSE Studio Onsite 1.3 | rubygem-passenger | 3.0.14-0.14.1 |
| SUSE WebYast 1.3 | rubygem-passenger | 3.0.14-0.14.1 |