Bug 892813 (CVE-2013-2119)
Summary: | CVE-2013-2119 rubygem-passenger: incorrect temporary file usage | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | bleanhar, brett.lentz, ccoleman, dmcphers, honglilai, jialiu, jlieskov, jrusnack, lmeyer, rmillner, security-response-team, tdawson, tkramer, vanmeeuwen+fedora |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2013-09-07 05:11:56 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 892227, 967177, 967178, 968923, 968930 | ||
Bug Blocks: | 892814 |
Description
Vincent Danen
2013-01-07 22:05:05 UTC
I have confirmed this is present in the passenger rubygem 4.0.3 (released May 24, 2013) as well 3.0.17 (the version Fedora 18 ships). This is now public and fixed in 3.0.21 and 4.0.5: http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ The source code fixes are available at: 4.0 series: https://github.com/FooBarWidget/passenger/commit/bfe619eec3a337b4868b9928dc273e70a4a96f37 3.0 series https://github.com/FooBarWidget/passenger/commit/0eaebb00f6b7327374069a7998064c68cc54e9f1 For the 3.0 series, 0eaebb00 is not complete. You also need 56d9d39f. This issue affects the versions of the rubygem-passenger package, as shipped with Fedora release of 17, 18, and Fedora EPEL-6. Please schedule an update. Created rubygem-passenger tracking bugs for this issue Affects: epel-6 [bug 968923] Created rubygem-passenger tracking bugs for this issue Affects: fedora-all [bug 968930] Acknowledgements: This issue was discovered by Michael Scherer of the Red Hat Regional IT team. This issue has been addressed in following products: RHEL 6 Version of OpenShift Enterprise 1.2 Via RHSA-2013:1136 https://rhn.redhat.com/errata/RHSA-2013-1136.html |