CVE-2018-12029: Race Condition
First published: Sun Jun 17 2018(Updated: )
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/passenger | 5.0.30-1.1 5.0.30-1.2+deb11u1 6.0.17+ds-1 | |
| Phusion Passenger | >=3.0.0<5.3.2 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/
- https://github.com/phusion/passenger/commit/207870f5b7f5cc240587ab0977d6046782ae1d86
- https://github.com/phusion/passenger/commit/9ed61bb4641ba1f5158fca3840d4e4088805b5af
- https://github.com/phusion/passenger/commit/4f663c8246f529e32575d50196d11cde12a6dfda
- https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc
- https://security-tracker.debian.org/tracker/CVE-2018-12029
- https://blog.phusion.nl/passenger-5-3-2
- https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html
- https://security.gentoo.org/glsa/201807-02
Frequently Asked Questions
What is CVE-2018-12029?
CVE-2018-12029 is a vulnerability in the nginx module in Phusion Passenger, which allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured.
How severe is CVE-2018-12029?
CVE-2018-12029 has a severity score of 7 (high).
Which software versions are affected by CVE-2018-12029?
Phusion Passenger versions 3.x through 5.x before 5.3.2 are affected by CVE-2018-12029.
How can I fix CVE-2018-12029?
To fix CVE-2018-12029, you should update Phusion Passenger to version 5.3.2 or later.
Where can I find more information about CVE-2018-12029?
You can find more information about CVE-2018-12029 at the following references: [1](https://blog.phusion.nl/passenger-5-3-2), [2](https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html), [3](https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc)
- collector/security-tracker-debian
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/phusion
- canonical/phusion passenger
- version/phusion passenger/3.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0