PT-2019-6814 · Ruby · Rubygems Passenger

Kurt Seifried · Published 2019-11-19 · Updated 2022-04-23 · CVE-2012-6135

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RubyGems passenger versions 4.0.0.beta1 through 4.0.0.beta2

Description The issue allows remote attackers to delete arbitrary files during the startup process. It affects both open source and Enterprise versions.

Recommendations For versions 4.0.0.beta1 and 4.0.0.beta2, consider restricting access to sensitive files during the startup process until a patch is available. As a temporary workaround, consider disabling the startup process temporarily to prevent exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-6135

GHSA-8MW8-J583-VQFG

Affected Products

Rubygems Passenger

References · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2012-6135.yml · Exploit
• https://osv.dev/vulnerability/GHSA-8mw8-j583-vqfg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6135 · Security Note
• http://openwall.com/lists/oss-security/2013/03/02/1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2012-6135 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6135 · Patch
• https://github.com/phusion/passenger · Note
• https://github.com/phusion/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541 · Note
• https://github.com/phusion/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82533 · Note
• https://securityfocus.com/bid/58259 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6135 · Note
• https://web.archive.org/web/20200918164919/https://old.blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability · Note