USN-5261-1

See a problem?

Source

https://ubuntu.com/security/notices/USN-5261-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5261-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-5261-1

Related

Published

2022-02-01T17:55:14.041554Z

Modified

2022-02-01T17:55:14.041554Z

Summary

passenger vulnerabilities

Details

It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to read arbitrary files. (CVE-2017-16355)

It was discovered that Phusion Passenger had a race condition in the nginx module that could be used to perform a symlink attack. An attacker could possibly use this issue to escalate privileges. (CVE-2018-12029)

References

Affected packages

Ubuntu:Pro:16.04:LTS / passenger

Package

Name: passenger
Purl: pkg:deb/ubuntu/passenger@5.0.27-2ubuntu0.1~esm1?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.27-2ubuntu0.1~esm1

Affected versions

5.*

5.0.7-3

5.0.22-1

5.0.22-1build1

5.0.22-1build2

5.0.27-2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "ruby-passenger": "5.0.27-2ubuntu0.1~esm1",
            "libapache2-mod-passenger-dbgsym": "5.0.27-2ubuntu0.1~esm1",
            "passenger-dbgsym": "5.0.27-2ubuntu0.1~esm1",
            "libapache2-mod-passenger": "5.0.27-2ubuntu0.1~esm1",
            "passenger-doc": "5.0.27-2ubuntu0.1~esm1",
            "passenger": "5.0.27-2ubuntu0.1~esm1",
            "ruby-passenger-doc": "5.0.27-2ubuntu0.1~esm1"
        }
    ]
}