Skip to content
OpenAdvisories
High USN-5261-1 2 CVEs

passenger vulnerabilities

Published Feb 1, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Phusion Passenger incorrectly handled a file path in
the application root folder. An attacker could possibly use this issue to
read arbitrary files. (CVE-2017-16355)

It was discovered that Phusion Passenger had a race condition in the nginx
module that could be used to perform a symlink attack. An attacker could
possibly use this issue to escalate privileges. (CVE-2018-12029)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS passenger 5.0.27-2ubuntu0.1~esm1

Vulnerabilities 2

  • High 7.0
    CVE-2018-12029

    Phusion Passenger Race Condition Allows Privilege Escalation

    A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a syml…

    passenger passenger passenger Debian Ubuntu RubyGems
  • Medium 4.7
    CVE-2017-16355

    Phusion Passenger information disclosure

    In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file n…

    passenger passenger passenger Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2017-16355
  • report
    https://ubuntu.com/security/CVE-2018-12029