ADVISORIES

• CVE-2014-1832 (NVD)
• GHSA-qw8w-2xcp-xg59
• OSVDB-102613

GEM

passenger

SEVERITY

CVSS v2.0: 2.1 (Low)

PATCHED VERSIONS

• >= 4.0.38

DESCRIPTION

‘Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.’