oss-security - CVE Request: rubygem passenger security issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130301164642.GA20979@suse.de>
Date: Fri, 1 Mar 2013 17:46:44 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: rubygem passenger security issue

Hi,

https://bugzilla.novell.com/show_bug.cgi?id=804722
https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541

Quoting:

There is a security issue regarding passenger that has been fixed in  
master. However, this does only apply if you deploy arbitrary  
untrusted apps on you server. Very unlikely for us but still I thought  
it was worth to inform you.

It fixes a security issue, but unless you're on a shared environment it's not a
grave issue. It allows an application process to delete an arbitrary file, even
a file it does not have permi
ssion to, but only during application startup (i.e. during evaluation of
config.ru). Once the application is started, it cannot be exploited, so
external visitors cannot influence this. If 
you deploy arbitrary untrusted apps on your server then this issue can be a
problem. If all your apps are trusted (e.g. because your organization wrote)
them then there's no problem.

Unquote

I am not sure this warrants a CVE.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.