GHSA-jjhj-8gx7-x836

Incorrect Access Control in Phusion Passenger

Source: GitHub Advisory Database (reviewed) High CVE-2018-12028

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	passenger	>= 5.3.0, < 5.3.2	5.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-12028 advisory
https://github.com/phusion/passenger/commit/1e7c82deb4901c438f583737d8c9f2aac264737c web
https://blog.phusion.nl/passenger-5-3-2 web
https://github.com/phusion/passenger package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12028.yml web
https://security.gentoo.org/glsa/201807-02 web