GitHub Advisoryadvisory · RubyGems

GHSA-fxwv-953p-7qpf Phusion Passenger allows remote attackers to spoof headers

LOW Published 2018-10-10 Modified 2023-07-05 Official page ↗
Aliases
CVE-2015-7519
Ecosystem
RubyGems
Packages
passenger
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems passenger: < 4.0.60 → fixed in 4.0.60 • RubyGems passenger: >= 5.0.0, < 5.0.22 → fixed in 5.0.22

Description

`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.

Related

Alias · CVE (1)

  • CVE-2015-7519 agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References