CVE-2018-12029: Race Condition
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passengerinstanceregistrydir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-12029?
CVE-2018-12029 is a vulnerability in the nginx module in Phusion Passenger, which allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured.
How severe is CVE-2018-12029?
CVE-2018-12029 has a severity score of 7 (high).
Which software versions are affected by CVE-2018-12029?
Phusion Passenger versions 3.x through 5.x before 5.3.2 are affected by CVE-2018-12029.
How can I fix CVE-2018-12029?
To fix CVE-2018-12029, you should update Phusion Passenger to version 5.3.2 or later.
Where can I find more information about CVE-2018-12029?
You can find more information about CVE-2018-12029 at the following references: [1](https://blog.phusion.nl/passenger-5-3-2), [2](https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html), [3](https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc)