Red Hat Bugzilla – Bug 917925
CVE-2012-6135 rubygem-passenger: untrusted apps Security check socket filenames reported by spawned application processes
Last modified: 2015-07-31 02:59:18 EDT
foobarwidget reports: It fixes a security issue, but unless you're on a shared environment it's not a grave issue. It allows an application process to delete an arbitrary file, even a file it does not have permission to, but only during application startup (i.e. during evaluation of config.ru). Once the application is started, it cannot be exploited, so external visitors cannot influence this. If you deploy arbitrary untrusted apps on your server then this issue can be a problem. If all your apps are trusted (e.g. because your organization wrote them) then there's no problem. https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541
Created rubygem-passenger tracking bugs for this issue Affects: epel-6 [bug 917928]
Created rubygem-passenger tracking bugs for this issue Affects: fedora-all [bug 917930]
We've released a security advisory here: http://blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/ Affected versions: Phusion Passenger open source 4.0.0 beta 1 Phusion Passenger open source 4.0.0 beta 2 Phusion Passenger Enterprise 4.0.0 beta 1 Phusion Passenger Enterprise 4.0.0 beta 2 Unaffected versions: Phusion Passenger open source 3.x and earlier Phusion Passenger open source 4.0.0 RC 1 and later Phusion Passenger Enterprise 3.x and earlier Phusion Passenger Enterprise 4.0.0 RC 1 and later
Statement: Not vulnerable. This issue did not affect the versions of rubygem-passenger as shipped with Red Hat OpenShift Enterprise 1.2 do not include the vulnerable code.