Description
mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mod-wsgi | 4.2.7-1 | — |
| Debian 13 | mod-wsgi | 4.2.7-1 | — |
| Debian 12 | mod-wsgi | 4.2.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | mod-wsgi | 3.4-4ubuntu2.1.14.04.2 | USN-2431-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mod_wsgi | 3.4-12.amzn2.0.1 | ALAS2-2018-987 |
Advisories 2
- USN-2431-1 mod-wsgi vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- ALAS2-2018-987 Moderate: mod_wsgi security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 5, 2018
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1111034
- 68111 vdb-entry
- http://advisories.mageia.org/MGASA-2014-0513.html
- http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html
- [oss-security] 20140619 CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] mailing-list
- GLSA-201612-49 vendor-advisory
- openSUSE-SU-2014:1590 vendor-advisory
- [oss-security] 20141104 Re: CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] mailing-list
- MDVSA-2014:253 vendor-advisory
- USN-2431-1 vendor-advisory