CVE-2013-2119: Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Jan 3, 2014

CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating…

–

CVSS

0.4%

EPSS

No

On KEV

Description

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 34% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OP

Openshift · Redhat

1.0 · source: NVD

PA

Passenger · Phusion

through 3.0.20; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +18 more · source: NVD

Affected product

PA

Passenger

Phusion

All Passenger CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2013-2119

https://www.cve.org/CVERecord?id=CVE-2013-2119

http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/

http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1136.html

https://bugzilla.redhat.com/show_bug.cgi?id=892813

More from Passenger

9.8

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories…

8.8

An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned…

7.8

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process,…

7.8

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the…

7.5

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method