GHSA-4284-jfhc-f854

Phusion Passenger incorrect permission assignment

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-12615

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	passenger	< 5.3.2	5.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-12615 advisory
https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8 web
https://github.com/phusion/passenger package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12615.yml web