github.com
https://github.com/phusion/passenger CVE-2018-12615
MEDIUM
Phusion Passenger incorrect permission assignment
Record summary
CVE-2018-12615 has a selected CVSS score of 5.3 (medium).
Description
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
passengerBrowse RubyGems / passenger | GitHub Advisory | Before 5.3.2 · Fixed in 5.3.2 | affected |
References
4github.com
https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8 github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12615.yml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-12615