PT-2014-2554 · Phusion · Phusion Passenger

Published 2013-07-09 · Updated 2023-02-13 · CVE-2013-2119

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phusion Passenger gem versions 3.0.0 through 3.0.20 Phusion Passenger gem versions 4.0.0 through 4.0.4

Description The issue allows local users to cause a denial of service or gain privileges by pre-creating a temporary config file in a directory with a predictable name in /tmp/ before it is used by the gem.

Recommendations For Phusion Passenger gem versions 3.0.0 through 3.0.20, update to version 3.0.21 or later. For Phusion Passenger gem versions 4.0.0 through 4.0.4, update to version 4.0.5 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-377

CWE-264

Related Identifiers

CVE-2013-2119

GHSA-9QJ7-JVG4-QR2X

MGASA-2013-0205

RHSA-2013:1136

SUSE-SU-2016:0042-1

Affected Products

Phusion Passenger

References · 27

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-2119.yml · Exploit
• http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2013-June/108443.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0205.html · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1136.html · Vendor Advisory
• http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qj7-jvg4-qr2x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2119 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2119 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-2119 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2119 · Security Note
• https://access.redhat.com/security/cve/CVE-2013-2119 · Note
• https://suse.com/security/cve/CVE-2013-4136 · Note