Skip to content
OpenAdvisories
Unscored RHSA-2013:1136 2 CVEs

Red Hat Security Advisory: rubygem-passenger security update

Published Sep 13, 2024 · Updated Mar 23, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · OpenShift 1 openshift:1.2::el6 mod_passenger 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-mod_passenger 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger-debuginfo 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger-devel 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger-doc 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger-native 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 ruby193-rubygem-passenger-native-libs 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-file-tail 0:1.0.5-4.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-file-tail-doc 0:1.0.5-4.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger-debuginfo 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger-devel 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger-doc 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger-native 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-passenger-native-libs 0:3.0.21-3.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-spruz 0:0.2.5-4.el6op
Red Hat · OpenShift 1 openshift:1.2::el6 rubygem-spruz-doc 0:0.2.5-4.el6op

Vulnerabilities 2

  • Medium —
    CVE-2013-2119

    Phusion Passenger Denial of Service

    Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before…

    passenger RubyGems
  • Medium —
    CVE-2013-4136

    insecure temporary directory usage in passenger

    ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

    passenger passenger Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=892813
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=985633
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1136.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-2119
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-2119
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-2119
  • report
    https://access.redhat.com/security/cve/CVE-2013-4136
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4136
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4136