CVE-2013-2119 — Insecure Temporary File in Passenger

CWE-264CWE-377 — Insecure Temporary File10 documents6 sources
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 82.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Phusion PassengerRedhat Openshift
Timeline
PublishedJan 3
Latest updateOct 24

Description

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages3 packages

▶RubyGemsphusion/passenger4.0.1 — 4.0.5+1
▶NVDphusion/passenger3.0.20+23

Patches

Patch: blog.phusion.nl ↗Patch: blog.phusion.nl ↗Patch: blog.phusion.nl ↗

🔴Vulnerability Details

4
OSV
Phusion Passenger Denial of Service↗2017-10-24
▶
GHSA
Phusion Passenger Denial of Service↗2017-10-24
▶
OSV
CVE-2013-2119: Phusion Passenger gem before 3↗2014-01-03
▶
CVEList
CVE-2013-2119: Phusion Passenger gem before 3↗2014-01-02
▶

📋Vendor Advisories

1
Red Hat
rubygem-passenger: incorrect temporary file usage↗2013-05-29
▶

💬Community

4
Bugzilla
CVE-2013-4136 rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories↗2013-07-18
▶
Bugzilla
CVE-2013-2119 rubygem-passenger: incorrect temporary file usage [fedora-all]↗2013-05-30
▶
Bugzilla
CVE-2013-2119 rubygem-passenger: incorrect temporary file usage [epel-6]↗2013-05-30
▶
Bugzilla
CVE-2013-2119 rubygem-passenger: incorrect temporary file usage↗2013-01-07
▶
CVE-2013-2119 — Insecure Temporary File in Passenger | cvebase