GitHub Advisoryadvisory · RubyGems

GHSA-4284-jfhc-f854 Phusion Passenger incorrect permission assignment

MEDIUM Published 2022-05-13 Modified 2022-06-17 Official page ↗
Aliases
CVE-2018-12615
Ecosystem
RubyGems
Packages
passenger
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-732
Reviewed
2022-06-17

Affected packages

• RubyGems passenger: < 5.3.2 → fixed in 5.3.2

Description

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

Related

Alias · CVE (1)

  • CVE-2018-12615 An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References