PT-2019-6814 · Ruby · Rubygems Passenger

Kurt Seifried · Publicado 2019-11-19 · Atualizado 2022-04-23 · CVE-2012-6135

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RubyGems passenger versions 4.0.0.beta1 through 4.0.0.beta2

Description The issue allows remote attackers to delete arbitrary files during the startup process. It affects both open source and Enterprise versions.

Recommendations For versions 4.0.0.beta1 and 4.0.0.beta2, consider restricting access to sensitive files during the startup process until a patch is available. As a temporary workaround, consider disabling the startup process temporarily to prevent exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-6135

GHSA-8MW8-J583-VQFG

Produtos afetados

Rubygems Passenger

Referências · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2012-6135.yml · Exploit
• https://github.com/phusion/passenger · Nota
• https://github.com/phusion/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541 · Nota
• https://github.com/phusion/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4 · Nota
• https://osv.dev/vulnerability/GHSA-8mw8-j583-vqfg · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82533 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6135 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/03/02/1 · Correção
• https://securityfocus.com/bid/58259 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6135 · Nota
• https://web.archive.org/web/20200918164919/https://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-6135 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6135 · Correção