Phusion Passenger incorrect permission assignment

GHSA-4284-jfhc-f854 · CVE-2018-12615

Published May 13, 2022 · Modified Nov 8, 2023

Description

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2018-12615
WEB https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
PACKAGE https://github.com/phusion/passenger
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12615.yml

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes