CVE-2018-12615: Medium severity Phusion Passenger vulnerability

Q: What is CVE-2018-12615?

CVE-2018-12615 is a vulnerability in Phusion Passenger before version 5.3.2 that allows uninitialized memory to set supplementary groups, potentially leading to privilege escalation.

Q: How does CVE-2018-12615 affect Phusion Passenger?

CVE-2018-12615 affects Phusion Passenger versions up to 5.3.2, potentially allowing unauthorized privilege escalation.

Q: What is the severity of CVE-2018-12615?

The severity of CVE-2018-12615 is medium, with a severity value of 5.3.

Q: How can I fix CVE-2018-12615?

To fix CVE-2018-12615, upgrade to Phusion Passenger version 5.3.2 or later.

Q: Is there any additional reference for CVE-2018-12615?

Yes, you can find more information about CVE-2018-12615 and the fix in the official GitHub repository of Phusion Passenger.

Published Jun 21, 2018

Updated

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

Affected Software

1 affected component

Phusion Passenger<5.3.2

Remediation

Patch Available

https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8

Event History

Jun 21, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is CVE-2018-12615?

CVE-2018-12615 is a vulnerability in Phusion Passenger before version 5.3.2 that allows uninitialized memory to set supplementary groups, potentially leading to privilege escalation.

How does CVE-2018-12615 affect Phusion Passenger?