CVE-2014-1832

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.1 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
phusionpassenger
𝑥
≤ 4.0.36
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
passenger
bullseye
5.0.30-1.2+deb11u1
fixed
wheezy
not-affected
bookworm
6.0.17+ds-1
fixed
sid
6.0.20+ds-1
fixed
trixie
6.0.20+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-passenger
disco
dne
cosmic
dne
bionic
dne
artful
dne
zesty
dne
yakkety
dne
xenial
dne
wily
ignored
vivid
ignored
utopic
ignored
trusty
dne
saucy
ignored
quantal
ignored
precise
dne
lucid
dne
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html
http://openwall.com/lists/oss-security/2014/01/29/6
http://openwall.com/lists/oss-security/2014/01/30/3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958
https://bugzilla.redhat.com/show_bug.cgi?id=1058992
https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html
http://openwall.com/lists/oss-security/2014/01/29/6
http://openwall.com/lists/oss-security/2014/01/30/3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958
https://bugzilla.redhat.com/show_bug.cgi?id=1058992
https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0