Description
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | passenger | 6.0.10-1 | — |
| Debian 13 | passenger | 6.0.10-1 | — |
| Debian 12 | passenger | 6.0.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | passenger | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE WebYast 1.3 | rubygem-passenger | 3.0.14-0.17.1 | SUSE-SU-2017:1316-1 |
| SUSE Studio Onsite 1.3 | rubygem-passenger | 3.0.14-0.17.1 | SUSE-SU-2017:1316-1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-passenger | 3.0.14-0.17.1 | SUSE-SU-2017:1316-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | passenger | < 5.1.0 | 5.1.0 | GHSA-cqxw-3p7v-p9gr |
Advisories 1
- SUSE-SU-2017:1316-1 Security update for rubygem-passenger SUSE / openSUSE Security Updates · Feb 4, 2026