Insecure use of temporary files in passenger · CVE-2014-1831 · GitHub Advisory Database · GitHub

Insecure use of temporary files in passenger

Low severity GitHub Reviewed Published Oct 10, 2018 to the GitHub Advisory Database • Updated Jul 5, 2023

Package

passenger (RubyGems)

Affected versions

< 4.0.38

Patched versions

4.0.38

Description

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on

control_process.pid or
a generation-* file.

References

Published by the National Vulnerability Database

Feb 19, 2015

Published to the GitHub Advisory Database Oct 10, 2018

Reviewed Jun 16, 2020

Last updated Jul 5, 2023