GitHub Advisoryadvisory · RubyGems

GHSA-9qj7-jvg4-qr2x Phusion Passenger Denial of Service

MEDIUM Published 2017-10-24 Modified 2023-07-05 Official page ↗
Aliases
CVE-2013-2119
Ecosystem
RubyGems
Packages
passenger
Severity
Moderate
Weaknesses
CWE-377
Reviewed
2020-06-16

Affected packages

• RubyGems passenger: < 3.0.21 → fixed in 3.0.21 • RubyGems passenger: >= 4.0.1, < 4.0.5 → fixed in 4.0.5

Description

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in `/tmp/` before it is used by the gem.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2013-2119 Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application… vulnerability

References