Lucene search
GoogleOSV:GHSA-CV3F-PX9R-54HMHistoryMay 13, 2022 - 1:30 a.m.
Phusion Passenger information disclosure
2022-05-1301:30:59
Google
osv.dev
27
0.001 Low
EPSS
Percentile
23.6%
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
References
blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11
github.com/phusion/passenger
github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf
github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2017-16355.yml
nvd.nist.gov/vuln/detail/CVE-2017-16355
seclists.org/bugtraq/2019/Mar/34
www.debian.org/security/2019/dsa-4415
Related
redhatcve
redhatcve
CVE-2017-16355
2017-12-20 02:49:53
debian
debian
[SECURITY] [DSA 4415-1] passenger security update
2019-03-24 11:02:30
[SECURITY] [DSA 4415-1] passenger security update
2019-03-24 11:02:30
osv
osv
CVE-2017-16355
2017-12-14 22:29:00
passenger - security update
2019-03-24 00:00:00
passenger vulnerabilities
2022-02-01 17:55:14
cve
cve
CVE-2017-16355
2017-12-14 22:29:00
CVE-2017-1000384
2017-12-15 10:29:00
nvd
nvd
CVE-2017-16355
2017-12-14 22:29:00
CVE-2017-1000384
2017-12-15 10:29:00
cvelist
cvelist
CVE-2017-16355
2017-12-14 22:00:00
veracode
veracode
Arbitrary File List Read
2017-11-20 02:23:04
nessus
nessus
FreeBSD : rubygem-passenger -- arbitrary file read vulnerability (8cf25a29-e063-11e7-9b2c-001e672571bc)
2017-12-19 00:00:00
Debian DSA-4415-1 : passenger - security update
2019-03-25 00:00:00
Ubuntu 16.04 ESM : Phusion Passenger vulnerabilities (USN-5261-1)
2023-10-20 00:00:00
freebsd
freebsd
rubygem-passenger -- arbitrary file read vulnerability
2017-10-13 00:00:00
github
github
Phusion Passenger information disclosure
2022-05-13 01:30:59
debiancve
debiancve
CVE-2017-16355
2017-12-14 22:29:00
prion
prion
Design/Logic Flaw
2017-12-14 22:29:00
openvas
openvas
Debian: Security Advisory (DSA-4415-1)
2019-03-23 00:00:00
Ubuntu: Security Advisory (USN-5261-1)
2023-01-27 00:00:00
SUSE: Security Advisory (SUSE-SU-2018:0262-1)
2021-06-09 00:00:00
ubuntucve
ubuntucve
CVE-2017-16355
2017-12-14 00:00:00
ubuntu
ubuntu
Phusion Passenger vulnerabilities
2022-02-01 00:00:00