Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2013-2119 (GCVE-0-2013-2119)
Vulnerability from cvelistv5
Published
2014-01-02 21:00
Modified
2024-08-06 15:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:27:40.872Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"name": "RHSA-2013:1136",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-05-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-02T20:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"name": "RHSA-2013:1136",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-2119",
"datePublished": "2014-01-02T21:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:27:40.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2013-2119\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-01-03T18:54:11.350\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \\\"config\\\" file in a directory with a predictable name in /tmp/ before it is used by the gem.\"},{\"lang\":\"es\",\"value\":\"Las versiones 3.0.21 y 4.0.x anteriores a 4.0.5 de la gema Phusion Passenger para Ruby permite a usuarios locales causar denegaci\u00f3n de servicio (prevenci\u00f3n de inicio de la aplicaci\u00f3n) u obtener privilegios creando un fichero \\\"config\\\" temporal en un directorio con un nombre predecible en /tmp/ antes de que sea utilizado por la gema.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.0.20\",\"matchCriteriaId\":\"EAC9E6F6-1C3C-4270-8360-97C0D1907D0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"079D1872-7E1B-4A66-9B3C-7FFC842A7BE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD8C8495-4011-4B96-BB78-430B1F508548\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3426ED-FAD6-47C5-94D3-A8BACFBEF270\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CD685C8-82D3-497A-84E9-238D19F15FE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40AD3808-45E1-4889-98AF-4267B9DB17A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36FCE653-AFE2-4291-872E-9CA8772F0CAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EF4B9EF-23CC-46E3-8700-36633924B9CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BAC8504-4F89-49AD-A06F-6A5A5B1DA34E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"522C4CC8-9B97-4E1D-B82B-073D14444909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9FEA652-5FFF-443F-983B-4FC5A4478F9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3907694B-8E1A-4C5B-ABF0-90F023845557\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2AA53B5-4F58-4D38-80D7-42771F2C295C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4472ABCB-B464-4640-A892-73B4C8CB609F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A2AA0F1-AB6F-4583-9AB1-38B7F69CE96D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EDAC43A-BC17-4F1E-BFF6-4C9180817E5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49FEE58A-FFDD-4E00-94F7-947D32CC1350\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09AFC97E-37EF-4D68-B947-C8FB43A11245\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2267254-554B-4AF2-A72B-0E346E4657C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:3.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C406BAD-DCF8-4C46-9731-A81EBF387F68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3C18671-5FB1-4C97-9FDD-6D495A748DF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECFAD875-6DB0-4D40-9A11-E02DA954B197\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1CC46D4-E33E-467C-B5C7-8F371D906A46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:phusion:passenger:4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2595C046-B304-42F3-8194-C259EFDBCA76\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"264DD094-A8CD-465D-B279-C834DDA5F79C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift:1.0:*:enterprise:*:*:*:*:*\",\"matchCriteriaId\":\"E038BCDC-E14F-4D37-981C-BB80853C148C\"}]}]}],\"references\":[{\"url\":\"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1136.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=892813\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1136.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=892813\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}"
}
}
rhsa-2013:1136
Vulnerability from csaf_redhat
Published
2013-08-05 15:48
Modified
2024-11-22 06:55
Summary
Red Hat Security Advisory: rubygem-passenger security update
Notes
Topic
Updated rubygem-passenger packages that fix two security issues are now
available for Red Hat OpenShift Enterprise 1.2.2.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
rubygem-passenger is a web server for Ruby, Python and Node.js
applications.
The rubygem-passenger gem created and re-used temporary directories and
files in an insecure fashion. A local attacker could use these flaws to
conduct a denial of service attack, take over the operation of the
application or, potentially, execute arbitrary code with the privileges of
the user running rubygem-passenger. (CVE-2013-2119, CVE-2013-4136)
Note: By default, OpenShift Enterprise uses polyinstantiation (per user)
for the /tmp/ directory, thereby minimizing the risk and impact of
exploitation by local attackers of both CVE-2013-2119 and CVE-2013-4136.
The CVE-2013-2119 issue was discovered by Michael Scherer of the Red Hat
Regional IT team.
The following packages are included with this update as dependencies of the
updated Ruby 1.8 passenger packages:
rubygem-spruz-0.2.5-4.el6op
rubygem-file-tail-1.0.5-4.el6op
Users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to
these updated packages, which correct these issues. After installing the
updated packages, manual action is required before the update takes effect.
Refer to the Solution section for details.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated rubygem-passenger packages that fix two security issues are now\navailable for Red Hat OpenShift Enterprise 1.2.2.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "rubygem-passenger is a web server for Ruby, Python and Node.js\napplications.\n\nThe rubygem-passenger gem created and re-used temporary directories and\nfiles in an insecure fashion. A local attacker could use these flaws to\nconduct a denial of service attack, take over the operation of the\napplication or, potentially, execute arbitrary code with the privileges of\nthe user running rubygem-passenger. (CVE-2013-2119, CVE-2013-4136)\n\nNote: By default, OpenShift Enterprise uses polyinstantiation (per user)\nfor the /tmp/ directory, thereby minimizing the risk and impact of\nexploitation by local attackers of both CVE-2013-2119 and CVE-2013-4136.\n\nThe CVE-2013-2119 issue was discovered by Michael Scherer of the Red Hat\nRegional IT team.\n\nThe following packages are included with this update as dependencies of the\nupdated Ruby 1.8 passenger packages:\n\nrubygem-spruz-0.2.5-4.el6op\nrubygem-file-tail-1.0.5-4.el6op\n\nUsers of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to\nthese updated packages, which correct these issues. After installing the\nupdated packages, manual action is required before the update takes effect.\nRefer to the Solution section for details.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:1136",
"url": "https://access.redhat.com/errata/RHSA-2013:1136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "892813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"category": "external",
"summary": "985633",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985633"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1136.json"
}
],
"title": "Red Hat Security Advisory: rubygem-passenger security update",
"tracking": {
"current_release_date": "2024-11-22T06:55:08+00:00",
"generator": {
"date": "2024-11-22T06:55:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:1136",
"initial_release_date": "2013-08-05T15:48:00+00:00",
"revision_history": [
{
"date": "2013-08-05T15:48:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-08-05T15:51:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:55:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHOSE Infrastructure 1.2",
"product": {
"name": "RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1.2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Node",
"product": {
"name": "Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1.2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"product": {
"name": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"product_id": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-spruz-doc@0.2.5-4.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-spruz-0:0.2.5-4.el6op.noarch",
"product": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.noarch",
"product_id": "rubygem-spruz-0:0.2.5-4.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-spruz@0.2.5-4.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"product": {
"name": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"product_id": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-file-tail-doc@1.0.5-4.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"product": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"product_id": "rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-file-tail@1.0.5-4.el6op?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-spruz-0:0.2.5-4.el6op.src",
"product": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.src",
"product_id": "rubygem-spruz-0:0.2.5-4.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-spruz@0.2.5-4.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-file-tail-0:1.0.5-4.el6op.src",
"product": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.src",
"product_id": "rubygem-file-tail-0:1.0.5-4.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-file-tail@1.0.5-4.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"product": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"product_id": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger@3.0.21-3.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-0:3.0.21-3.el6op.src",
"product": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.src",
"product_id": "rubygem-passenger-0:3.0.21-3.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger@3.0.21-3.el6op?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-doc@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-debuginfo@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-mod_passenger@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-native@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-devel@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-native-libs@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger-doc@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger-devel@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger-native@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_passenger-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "mod_passenger-0:3.0.21-3.el6op.x86_64",
"product_id": "mod_passenger-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_passenger@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger-native-libs@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger@3.0.21-3.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product": {
"name": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product_id": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-passenger-debuginfo@3.0.21-3.el6op?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "mod_passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch"
},
"product_reference": "rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.src as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src"
},
"product_reference": "rubygem-file-tail-0:1.0.5-4.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch"
},
"product_reference": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.src as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src"
},
"product_reference": "rubygem-passenger-0:3.0.21-3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch"
},
"product_reference": "rubygem-spruz-0:0.2.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.src as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src"
},
"product_reference": "rubygem-spruz-0:0.2.5-4.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2",
"product_id": "6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
},
"product_reference": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "mod_passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch"
},
"product_reference": "rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-0:1.0.5-4.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src"
},
"product_reference": "rubygem-file-tail-0:1.0.5-4.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch"
},
"product_reference": "rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src"
},
"product_reference": "rubygem-passenger-0:3.0.21-3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64"
},
"product_reference": "rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch"
},
"product_reference": "rubygem-spruz-0:0.2.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-0:0.2.5-4.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src"
},
"product_reference": "rubygem-spruz-0:0.2.5-4.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
},
"product_reference": "rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Michael Scherer"
],
"organization": "Red Hat Regional IT team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-2119",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892813"
}
],
"notes": [
{
"category": "description",
"text": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-passenger: incorrect temporary file usage",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2119"
},
{
"category": "external",
"summary": "RHBZ#892813",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2119",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119"
}
],
"release_date": "2013-05-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-05T15:48:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nManual action is required for this update to take effect. In order for the\nupdated passenger packages to be loaded by Ruby applications in the PaaS,\nthe applications must be restarted with oo-admin-ctl-gears. One way to\naccomplish this is by running the following command, as a single line\nwithout the line break, on all OpenShift Nodes:\n\nfor rubyapp in `ls -d /var/lib/openshift/*/ruby |\ncut -f5 -d/`; do oo-admin-ctl-gears restartgear $rubyapp; done\n\nIf there are no Ruby applications on a Node it will simply fail with the\nmessage \"No such file or directory\". Another option is to run the\nfollowing on all OpenShift Nodes; however, it will result in non-Ruby\napplications also being restarted:\n\noo-admin-ctl-gears restartall\n\n(Note that without the manual action, if a user attempts to restart their\nRuby application via the rhc command line, it will fail to start with a\n\"Passenger could not be initialized...\" error.)",
"product_ids": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1136"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-passenger: incorrect temporary file usage"
},
{
"cve": "CVE-2013-4136",
"discovery_date": "2013-07-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "985633"
}
],
"notes": [
{
"category": "description",
"text": "ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-4136"
},
{
"category": "external",
"summary": "RHBZ#985633",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985633"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-4136",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4136"
}
],
"release_date": "2013-06-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-05T15:48:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258\n\nManual action is required for this update to take effect. In order for the\nupdated passenger packages to be loaded by Ruby applications in the PaaS,\nthe applications must be restarted with oo-admin-ctl-gears. One way to\naccomplish this is by running the following command, as a single line\nwithout the line break, on all OpenShift Nodes:\n\nfor rubyapp in `ls -d /var/lib/openshift/*/ruby |\ncut -f5 -d/`; do oo-admin-ctl-gears restartgear $rubyapp; done\n\nIf there are no Ruby applications on a Node it will simply fail with the\nmessage \"No such file or directory\". Another option is to run the\nfollowing on all OpenShift Nodes; however, it will result in non-Ruby\napplications also being restarted:\n\noo-admin-ctl-gears restartall\n\n(Note that without the manual action, if a user attempts to restart their\nRuby application via the rhc command line, it will fail to start with a\n\"Passenger could not be initialized...\" error.)",
"product_ids": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1136"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-INFRA-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-INFRA-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-0:1.0.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.noarch",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-0:0.2.5-4.el6op.src",
"6Server-RHOSE-NODE-1.2:rubygem-spruz-doc-0:0.2.5-4.el6op.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories"
}
]
}
opensuse-su-2024:11341-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media
Notes
Title of the patch
ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media
Description of the patch
These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11341
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11341",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11341-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-2119 page",
"url": "https://www.suse.com/security/cve/CVE-2013-2119/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4547 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4547/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-1831 page",
"url": "https://www.suse.com/security/cve/CVE-2014-1831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-1832 page",
"url": "https://www.suse.com/security/cve/CVE-2014-1832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7519 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7519/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-1247 page",
"url": "https://www.suse.com/security/cve/CVE-2016-1247/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-7529 page",
"url": "https://www.suse.com/security/cve/CVE-2017-7529/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-12026 page",
"url": "https://www.suse.com/security/cve/CVE-2018-12026/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-12029 page",
"url": "https://www.suse.com/security/cve/CVE-2018-12029/"
}
],
"title": "ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11341-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"product": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"product_id": "ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"product": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"product_id": "ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-6.0.8-3.2.aarch64",
"product": {
"name": "rubygem-passenger-6.0.8-3.2.aarch64",
"product_id": "rubygem-passenger-6.0.8-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"product": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"product_id": "rubygem-passenger-apache2-6.0.8-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"product": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"product_id": "rubygem-passenger-nginx-6.0.8-3.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"product": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"product_id": "ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"product": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"product_id": "ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-6.0.8-3.2.ppc64le",
"product": {
"name": "rubygem-passenger-6.0.8-3.2.ppc64le",
"product_id": "rubygem-passenger-6.0.8-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"product": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"product_id": "rubygem-passenger-apache2-6.0.8-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"product": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"product_id": "rubygem-passenger-nginx-6.0.8-3.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"product": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"product_id": "ruby2.7-rubygem-passenger-6.0.8-3.2.s390x"
}
},
{
"category": "product_version",
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"product": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"product_id": "ruby3.0-rubygem-passenger-6.0.8-3.2.s390x"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-6.0.8-3.2.s390x",
"product": {
"name": "rubygem-passenger-6.0.8-3.2.s390x",
"product_id": "rubygem-passenger-6.0.8-3.2.s390x"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-apache2-6.0.8-3.2.s390x",
"product": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.s390x",
"product_id": "rubygem-passenger-apache2-6.0.8-3.2.s390x"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-6.0.8-3.2.s390x",
"product": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.s390x",
"product_id": "rubygem-passenger-nginx-6.0.8-3.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"product": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"product_id": "ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"product": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"product_id": "ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-6.0.8-3.2.x86_64",
"product": {
"name": "rubygem-passenger-6.0.8-3.2.x86_64",
"product_id": "rubygem-passenger-6.0.8-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"product": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"product_id": "rubygem-passenger-apache2-6.0.8-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-6.0.8-3.2.x86_64",
"product": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.x86_64",
"product_id": "rubygem-passenger-nginx-6.0.8-3.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64"
},
"product_reference": "ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le"
},
"product_reference": "ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x"
},
"product_reference": "ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64"
},
"product_reference": "ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64"
},
"product_reference": "ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le"
},
"product_reference": "ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x"
},
"product_reference": "ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64"
},
"product_reference": "ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-6.0.8-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64"
},
"product_reference": "rubygem-passenger-6.0.8-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-6.0.8-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le"
},
"product_reference": "rubygem-passenger-6.0.8-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-6.0.8-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x"
},
"product_reference": "rubygem-passenger-6.0.8-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-6.0.8-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64"
},
"product_reference": "rubygem-passenger-6.0.8-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64"
},
"product_reference": "rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le"
},
"product_reference": "rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x"
},
"product_reference": "rubygem-passenger-apache2-6.0.8-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-apache2-6.0.8-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64"
},
"product_reference": "rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64"
},
"product_reference": "rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le"
},
"product_reference": "rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x"
},
"product_reference": "rubygem-passenger-nginx-6.0.8-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-6.0.8-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
},
"product_reference": "rubygem-passenger-nginx-6.0.8-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-2119",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-2119"
}
],
"notes": [
{
"category": "general",
"text": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-2119",
"url": "https://www.suse.com/security/cve/CVE-2013-2119"
},
{
"category": "external",
"summary": "SUSE Bug 828005 for CVE-2013-2119",
"url": "https://bugzilla.suse.com/828005"
},
{
"category": "external",
"summary": "SUSE Bug 919726 for CVE-2013-2119",
"url": "https://bugzilla.suse.com/919726"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2013-2119"
},
{
"cve": "CVE-2013-4547",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4547"
}
],
"notes": [
{
"category": "general",
"text": "nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4547",
"url": "https://www.suse.com/security/cve/CVE-2013-4547"
},
{
"category": "external",
"summary": "SUSE Bug 851295 for CVE-2013-4547",
"url": "https://bugzilla.suse.com/851295"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2013-4547"
},
{
"cve": "CVE-2014-1831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-1831"
}
],
"notes": [
{
"category": "general",
"text": "Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-1831",
"url": "https://www.suse.com/security/cve/CVE-2014-1831"
},
{
"category": "external",
"summary": "SUSE Bug 860994 for CVE-2014-1831",
"url": "https://bugzilla.suse.com/860994"
},
{
"category": "external",
"summary": "SUSE Bug 864352 for CVE-2014-1831",
"url": "https://bugzilla.suse.com/864352"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-1831"
},
{
"cve": "CVE-2014-1832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-1832"
}
],
"notes": [
{
"category": "general",
"text": "Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-1832",
"url": "https://www.suse.com/security/cve/CVE-2014-1832"
},
{
"category": "external",
"summary": "SUSE Bug 860994 for CVE-2014-1832",
"url": "https://bugzilla.suse.com/860994"
},
{
"category": "external",
"summary": "SUSE Bug 864352 for CVE-2014-1832",
"url": "https://bugzilla.suse.com/864352"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-1832"
},
{
"cve": "CVE-2015-7519",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7519"
}
],
"notes": [
{
"category": "general",
"text": "agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7519",
"url": "https://www.suse.com/security/cve/CVE-2015-7519"
},
{
"category": "external",
"summary": "SUSE Bug 956281 for CVE-2015-7519",
"url": "https://bugzilla.suse.com/956281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7519"
},
{
"cve": "CVE-2016-1247",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-1247"
}
],
"notes": [
{
"category": "general",
"text": "The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-1247",
"url": "https://www.suse.com/security/cve/CVE-2016-1247"
},
{
"category": "external",
"summary": "SUSE Bug 1007000 for CVE-2016-1247",
"url": "https://bugzilla.suse.com/1007000"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-1247"
},
{
"cve": "CVE-2017-7529",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-7529"
}
],
"notes": [
{
"category": "general",
"text": "Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-7529",
"url": "https://www.suse.com/security/cve/CVE-2017-7529"
},
{
"category": "external",
"summary": "SUSE Bug 1048265 for CVE-2017-7529",
"url": "https://bugzilla.suse.com/1048265"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-7529"
},
{
"cve": "CVE-2018-12026",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-12026"
}
],
"notes": [
{
"category": "general",
"text": "During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-12026",
"url": "https://www.suse.com/security/cve/CVE-2018-12026"
},
{
"category": "external",
"summary": "SUSE Bug 1097655 for CVE-2018-12026",
"url": "https://bugzilla.suse.com/1097655"
},
{
"category": "external",
"summary": "SUSE Bug 1097663 for CVE-2018-12026",
"url": "https://bugzilla.suse.com/1097663"
},
{
"category": "external",
"summary": "SUSE Bug 1097664 for CVE-2018-12026",
"url": "https://bugzilla.suse.com/1097664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2018-12026"
},
{
"cve": "CVE-2018-12029",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-12029"
}
],
"notes": [
{
"category": "general",
"text": "A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root\u0027s crontab file allows privilege escalation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-12029",
"url": "https://www.suse.com/security/cve/CVE-2018-12029"
},
{
"category": "external",
"summary": "SUSE Bug 1097655 for CVE-2018-12029",
"url": "https://bugzilla.suse.com/1097655"
},
{
"category": "external",
"summary": "SUSE Bug 1097663 for CVE-2018-12029",
"url": "https://bugzilla.suse.com/1097663"
},
{
"category": "external",
"summary": "SUSE Bug 1097664 for CVE-2018-12029",
"url": "https://bugzilla.suse.com/1097664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby2.7-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:ruby3.0-rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-apache2-6.0.8-3.2.x86_64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.aarch64",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.ppc64le",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.s390x",
"openSUSE Tumbleweed:rubygem-passenger-nginx-6.0.8-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-12029"
}
]
}
ghsa-9qj7-jvg4-qr2x
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-07-05 18:50
VLAI Severity ?
Summary
Phusion Passenger Denial of Service
Details
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.1"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2119"
],
"database_specific": {
"cwe_ids": [
"CWE-377"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:29:24Z",
"nvd_published_at": "2014-01-03T18:54:00Z",
"severity": "MODERATE"
},
"details": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in `/tmp/` before it is used by the gem.",
"id": "GHSA-9qj7-jvg4-qr2x",
"modified": "2023-07-05T18:50:18Z",
"published": "2017-10-24T18:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2013:1136"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2013-2119"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-9qj7-jvg4-qr2x"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-2119.yml"
},
{
"type": "WEB",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released"
},
{
"type": "WEB",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Phusion Passenger Denial of Service"
}
gsd-2013-2119
Vulnerability from gsd
Modified
2013-05-29 00:00
Details
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2013-2119",
"description": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"id": "GSD-2013-2119",
"references": [
"https://www.suse.com/security/cve/CVE-2013-2119.html",
"https://access.redhat.com/errata/RHSA-2013:1136",
"https://advisories.mageia.org/CVE-2013-2119.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "passenger",
"purl": "pkg:gem/passenger"
}
}
],
"aliases": [
"CVE-2013-2119",
"OSVDB-93752"
],
"details": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"id": "GSD-2013-2119",
"modified": "2013-05-29T00:00:00.000Z",
"published": "2013-05-29T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 4.6,
"type": "CVSS_V2"
}
],
"summary": "CVE-2013-2119 rubygem-passenger: incorrect temporary file usage"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-2119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/",
"refsource": "MISC",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"name": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/",
"refsource": "MISC",
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-1136.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=892813",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2013-2119",
"cvss_v2": 4.6,
"date": "2013-05-29",
"description": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"gem": "passenger",
"osvdb": 93752,
"patched_versions": [
"~\u003e 3.0.21",
"\u003e= 4.0.5"
],
"title": "CVE-2013-2119 rubygem-passenger: incorrect temporary file usage",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2119"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0 \u003c3.0.21 || \u003e=4.0.0 \u003c4.0.5",
"affected_versions": "All versions starting from 3.0.0 before 3.0.21, all versions starting from 4.0.0 before 4.0.5",
"credit": "Michael Scherer",
"cvss_v2": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"cwe_ids": [
"CWE-1035",
"CWE-264",
"CWE-937"
],
"date": "2016-12-06",
"description": "The passenger ruby gem, when used in standalone mode, does not use temporary files securely. If a local attacker were able to create a temporary directory that passenger uses and supply a custom nginx configuration file they could start a nginx instance with their own configuration file.",
"fixed_versions": [
"3.0.21",
"4.0.5"
],
"identifier": "CVE-2013-2119",
"identifiers": [
"CVE-2013-2119"
],
"package_slug": "gem/passenger",
"pubdate": "2014-01-03",
"solution": "Update to latest 3.0.X or 4.0.X",
"title": "Incorrect temporary file usage",
"urls": [
"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2119",
"https://bugzilla.redhat.com/show_bug.cgi?id=892813"
],
"uuid": "76fb1e27-a19f-46e8-900a-8a7f2b6608e9"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.0.20",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:3.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:4.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phusion:passenger:4.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:openshift:1.0:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-2119"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=892813",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"name": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
},
{
"name": "RHSA-2013:1136",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2023-02-13T04:42Z",
"publishedDate": "2014-01-03T18:54Z"
}
}
}
fkie_cve-2013-2119
Vulnerability from fkie_nvd
Published
2014-01-03 18:54
Modified
2025-04-11 00:51
Severity ?
Summary
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ | Patch, Vendor Advisory | |
| secalert@redhat.com | http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ | Patch, Vendor Advisory | |
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2013-1136.html | Third Party Advisory | |
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=892813 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1136.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=892813 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phusion | passenger | * | |
| phusion | passenger | 3.0.0 | |
| phusion | passenger | 3.0.1 | |
| phusion | passenger | 3.0.2 | |
| phusion | passenger | 3.0.3 | |
| phusion | passenger | 3.0.4 | |
| phusion | passenger | 3.0.5 | |
| phusion | passenger | 3.0.6 | |
| phusion | passenger | 3.0.7 | |
| phusion | passenger | 3.0.8 | |
| phusion | passenger | 3.0.9 | |
| phusion | passenger | 3.0.10 | |
| phusion | passenger | 3.0.11 | |
| phusion | passenger | 3.0.12 | |
| phusion | passenger | 3.0.13 | |
| phusion | passenger | 3.0.14 | |
| phusion | passenger | 3.0.15 | |
| phusion | passenger | 3.0.17 | |
| phusion | passenger | 3.0.18 | |
| phusion | passenger | 3.0.19 | |
| phusion | passenger | 4.0.1 | |
| phusion | passenger | 4.0.2 | |
| phusion | passenger | 4.0.3 | |
| phusion | passenger | 4.0.4 | |
| ruby-lang | ruby | * | |
| redhat | openshift | 1.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC9E6F6-1C3C-4270-8360-97C0D1907D0C",
"versionEndIncluding": "3.0.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "079D1872-7E1B-4A66-9B3C-7FFC842A7BE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD8C8495-4011-4B96-BB78-430B1F508548",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D3426ED-FAD6-47C5-94D3-A8BACFBEF270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6CD685C8-82D3-497A-84E9-238D19F15FE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40AD3808-45E1-4889-98AF-4267B9DB17A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "36FCE653-AFE2-4291-872E-9CA8772F0CAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5EF4B9EF-23CC-46E3-8700-36633924B9CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "4BAC8504-4F89-49AD-A06F-6A5A5B1DA34E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "522C4CC8-9B97-4E1D-B82B-073D14444909",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E9FEA652-5FFF-443F-983B-4FC5A4478F9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3907694B-8E1A-4C5B-ABF0-90F023845557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D2AA53B5-4F58-4D38-80D7-42771F2C295C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4472ABCB-B464-4640-A892-73B4C8CB609F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "0A2AA0F1-AB6F-4583-9AB1-38B7F69CE96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8EDAC43A-BC17-4F1E-BFF6-4C9180817E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "49FEE58A-FFDD-4E00-94F7-947D32CC1350",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "09AFC97E-37EF-4D68-B947-C8FB43A11245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "E2267254-554B-4AF2-A72B-0E346E4657C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:3.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "5C406BAD-DCF8-4C46-9731-A81EBF387F68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E3C18671-5FB1-4C97-9FDD-6D495A748DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "ECFAD875-6DB0-4D40-9A11-E02DA954B197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A1CC46D4-E33E-467C-B5C7-8F371D906A46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phusion:passenger:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2595C046-B304-42F3-8194-C259EFDBCA76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"matchCriteriaId": "264DD094-A8CD-465D-B279-C834DDA5F79C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:openshift:1.0:*:enterprise:*:*:*:*:*",
"matchCriteriaId": "E038BCDC-E14F-4D37-981C-BB80853C148C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."
},
{
"lang": "es",
"value": "Las versiones 3.0.21 y 4.0.x anteriores a 4.0.5 de la gema Phusion Passenger para Ruby permite a usuarios locales causar denegaci\u00f3n de servicio (prevenci\u00f3n de inicio de la aplicaci\u00f3n) u obtener privilegios creando un fichero \"config\" temporal en un directorio con un nombre predecible en /tmp/ antes de que sea utilizado por la gema."
}
],
"id": "CVE-2013-2119",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-03T18:54:11.350",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1136.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892813"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
suse-su-2016:0042-1
Vulnerability from csaf_suse
Published
2016-01-07 09:33
Modified
2016-01-07 09:33
Summary
Security update for rubygem-passenger
Notes
Title of the patch
Security update for rubygem-passenger
Description of the patch
This update fixes the following security issues:
- CVE-2015-7519: Passenger is not filtering
environment like apache is doing (bnc#956281)
- CVE-2013-4136: Fixed security issue Passenger would reuse existing server instance directories
(temporary directories) which could cause Passenger to remove or
overwrite files belonging to other instances. Solution:
If the server instance directory already exists, it will now be
removed first in order get correct directory permissions. If the
directory still exists after removal, Phusion Passenger aborts to
avoid writing to a directory with unexpected permissions.(bnc#919726)
- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)
Patchnames
sleslms13-rubygem-passenger-12303,slestso13-rubygem-passenger-12303,slewyst13-rubygem-passenger-12303
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for rubygem-passenger",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\n\nThis update fixes the following security issues:\n\n- CVE-2015-7519: Passenger is not filtering\n environment like apache is doing (bnc#956281)\n\n- CVE-2013-4136: Fixed security issue Passenger would reuse existing server instance directories\n (temporary directories) which could cause Passenger to remove or\n overwrite files belonging to other instances. Solution:\n If the server instance directory already exists, it will now be\n removed first in order get correct directory permissions. If the\n directory still exists after removal, Phusion Passenger aborts to\n avoid writing to a directory with unexpected permissions.(bnc#919726) \n\n- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005) ",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleslms13-rubygem-passenger-12303,slestso13-rubygem-passenger-12303,slewyst13-rubygem-passenger-12303",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0042-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:0042-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:0042-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-January/001784.html"
},
{
"category": "self",
"summary": "SUSE Bug 828005",
"url": "https://bugzilla.suse.com/828005"
},
{
"category": "self",
"summary": "SUSE Bug 919726",
"url": "https://bugzilla.suse.com/919726"
},
{
"category": "self",
"summary": "SUSE Bug 956281",
"url": "https://bugzilla.suse.com/956281"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-2119 page",
"url": "https://www.suse.com/security/cve/CVE-2013-2119/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-4136 page",
"url": "https://www.suse.com/security/cve/CVE-2013-4136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7519 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7519/"
}
],
"title": "Security update for rubygem-passenger",
"tracking": {
"current_release_date": "2016-01-07T09:33:34Z",
"generator": {
"date": "2016-01-07T09:33:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:0042-1",
"initial_release_date": "2016-01-07T09:33:34Z",
"revision_history": [
{
"date": "2016-01-07T09:33:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "rubygem-passenger-3.0.14-0.14.1.i586",
"product": {
"name": "rubygem-passenger-3.0.14-0.14.1.i586",
"product_id": "rubygem-passenger-3.0.14-0.14.1.i586"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"product": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"product_id": "rubygem-passenger-nginx-3.0.14-0.14.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-passenger-3.0.14-0.14.1.ia64",
"product": {
"name": "rubygem-passenger-3.0.14-0.14.1.ia64",
"product_id": "rubygem-passenger-3.0.14-0.14.1.ia64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"product": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"product_id": "rubygem-passenger-nginx-3.0.14-0.14.1.ia64"
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-passenger-3.0.14-0.14.1.ppc64",
"product": {
"name": "rubygem-passenger-3.0.14-0.14.1.ppc64",
"product_id": "rubygem-passenger-3.0.14-0.14.1.ppc64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"product": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"product_id": "rubygem-passenger-nginx-3.0.14-0.14.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-passenger-3.0.14-0.14.1.s390x",
"product": {
"name": "rubygem-passenger-3.0.14-0.14.1.s390x",
"product_id": "rubygem-passenger-3.0.14-0.14.1.s390x"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"product": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"product_id": "rubygem-passenger-nginx-3.0.14-0.14.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-passenger-3.0.14-0.14.1.x86_64",
"product": {
"name": "rubygem-passenger-3.0.14-0.14.1.x86_64",
"product_id": "rubygem-passenger-3.0.14-0.14.1.x86_64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"product": {
"name": "rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"product_id": "rubygem-passenger-apache2-3.0.14-0.14.1.x86_64"
}
},
{
"category": "product_version",
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"product": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"product_id": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Lifecycle Management Server 1.3",
"product": {
"name": "SUSE Lifecycle Management Server 1.3",
"product_id": "SUSE Lifecycle Management Server 1.3",
"product_identification_helper": {
"cpe": "cpe:/a:suse:sle-slms:1.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Studio Onsite 1.3",
"product": {
"name": "SUSE Studio Onsite 1.3",
"product_id": "SUSE Studio Onsite 1.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-studioonsite:1.3"
}
}
},
{
"category": "product_name",
"name": "SUSE WebYast 1.3",
"product": {
"name": "SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:webyast:1.3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.x86_64 as component of SUSE Lifecycle Management Server 1.3",
"product_id": "SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE Lifecycle Management Server 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-apache2-3.0.14-0.14.1.x86_64 as component of SUSE Lifecycle Management Server 1.3",
"product_id": "SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE Lifecycle Management Server 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64 as component of SUSE Lifecycle Management Server 1.3",
"product_id": "SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE Lifecycle Management Server 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.x86_64 as component of SUSE Studio Onsite 1.3",
"product_id": "SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE Studio Onsite 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64 as component of SUSE Studio Onsite 1.3",
"product_id": "SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE Studio Onsite 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.i586 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.i586",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.ia64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.ia64",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.ppc64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.ppc64",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.s390x as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.s390x",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-3.0.14-0.14.1.x86_64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.i586 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ia64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.ppc64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.s390x as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"relates_to_product_reference": "SUSE WebYast 1.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64 as component of SUSE WebYast 1.3",
"product_id": "SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
},
"product_reference": "rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"relates_to_product_reference": "SUSE WebYast 1.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-2119",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-2119"
}
],
"notes": [
{
"category": "general",
"text": "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-2119",
"url": "https://www.suse.com/security/cve/CVE-2013-2119"
},
{
"category": "external",
"summary": "SUSE Bug 828005 for CVE-2013-2119",
"url": "https://bugzilla.suse.com/828005"
},
{
"category": "external",
"summary": "SUSE Bug 919726 for CVE-2013-2119",
"url": "https://bugzilla.suse.com/919726"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T09:33:34Z",
"details": "moderate"
}
],
"title": "CVE-2013-2119"
},
{
"cve": "CVE-2013-4136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-4136"
}
],
"notes": [
{
"category": "general",
"text": "ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-4136",
"url": "https://www.suse.com/security/cve/CVE-2013-4136"
},
{
"category": "external",
"summary": "SUSE Bug 624673 for CVE-2013-4136",
"url": "https://bugzilla.suse.com/624673"
},
{
"category": "external",
"summary": "SUSE Bug 919726 for CVE-2013-4136",
"url": "https://bugzilla.suse.com/919726"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T09:33:34Z",
"details": "moderate"
}
],
"title": "CVE-2013-4136"
},
{
"cve": "CVE-2015-7519",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7519"
}
],
"notes": [
{
"category": "general",
"text": "agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7519",
"url": "https://www.suse.com/security/cve/CVE-2015-7519"
},
{
"category": "external",
"summary": "SUSE Bug 956281 for CVE-2015-7519",
"url": "https://bugzilla.suse.com/956281"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1.x86_64",
"SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1.x86_64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.i586",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ia64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.ppc64",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.s390x",
"SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T09:33:34Z",
"details": "moderate"
}
],
"title": "CVE-2015-7519"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…