CVE-2014-1832: Low severity phusion passenger vulnerability
Published Feb 19, 2015
·Updated
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) controlprocess.pid or a (2) generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
Affected Software
3 affected componentsFixes available
rubygems/passenger=4.0.37
4.0.38
debian/passenger
5.0.30-1.2+deb11u16.0.17+ds-16.0.20+ds-1
Phusion Passenger<=4.0.36
Event History
Feb 19, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Oct 10, 2018
Advisory Published
05:29 PM
Frequently Asked Questions
1
What is the severity of CVE-2014-1832?
CVE-2014-1832 is a moderate severity vulnerability that allows local users to modify certain files through a symlink attack.
2
How do I fix CVE-2014-1832?
To fix CVE-2014-1832, upgrade Phusion Passenger to version 4.0.38 or later.
3
What are the affected versions of Phusion Passenger for CVE-2014-1832?
Phusion Passenger versions up to and including 4.0.36 are affected by CVE-2014-1832.
4
What is the nature of the vulnerability in CVE-2014-1832?
CVE-2014-1832 allows local users to write to files like control_process.pid or generation-* files via a symlink attack.
5
Is CVE-2014-1832 related to any previous vulnerabilities?
Yes, CVE-2014-1832 is linked to an incomplete fix for CVE-2014-1831.