CVE-2017-16355: Infoleak
First published: Thu Dec 14 2017(Updated: )
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/passenger | 5.0.30-1.1 5.0.30-1.2+deb11u1 6.0.17+ds-1 | |
| Phusion Passenger | >=5.0.10<5.1.10 | |
| Phusion Passenger | >=5.0.10<5.1.11 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2017-16355
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16355
- https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/
- https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf
- https://security-tracker.debian.org/tracker/CVE-2018-12029
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884463
- https://www.openwall.com/lists/oss-security/2017/11/21/2
- https://seclists.org/bugtraq/2019/Mar/34
- https://www.debian.org/security/2019/dsa-4415
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-16355.
What software versions are affected by this vulnerability?
Phusion Passenger 5.1.10, Passenger Open Source 5.1.11, and Passenger Enterprise 5.1.10 are affected by this vulnerability.
How can the contents of arbitrary files be listed with this vulnerability?
By symlinking a file named REVISION from the application root, it is possible to list the contents of arbitrary files on a system.
What is the severity rating of this vulnerability?
This vulnerability has a severity rating of medium with a value of 4.7.
How can I fix this vulnerability?
To fix this vulnerability, upgrade to Passenger Open Source 5.1.11 or Passenger Enterprise 5.1.10.
- collector/debian-bugs
- alias/CVE-2017-16355
- collector/security-tracker-debian
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/event
- agent/tags
- agent/first-publish-date
- agent/description
- package-manager/debian
- vendor/phusion
- canonical/phusion passenger
- version/phusion passenger/5.0.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0