CVE-2017-16355
Fixed in a distro release EPSS <1%
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
Products: phusion passenger, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | passenger | 5.1.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | passenger | 5.0.30-1.1 |
| Debian 13 | passenger | 5.0.30-1.1 |
| Debian 14 | passenger | 5.0.30-1.1 |
| Debian 9 | passenger | 5.0.30-1+deb9u1 |
| SUSE Linux Enterprise Module for Containers 12 | rubygem-passenger | 5.0.18-12.5.1 |
| Ubuntu 18.04 LTS | passenger | 5.0.30-1+deb9u1build0.18.04.1 |
| Ubuntu Pro 16.04 LTS | passenger | 5.0.27-2ubuntu0.1~esm1 |