Source: passenger Version: 5.0.30-1 Severity: important Tags: patch security upstream fixed-upstrream
Hi, the following vulnerability was published for passenger. CVE-2017-16355[0]: | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed | in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if | Passenger is running as root, it is possible to list the contents of | arbitrary files on a system by symlinking a file named REVISION from | the application root folder to a file of choice and querying | passenger-status --show=xml. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-16355 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16355 [1] https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/ [2] https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf Regards, Salvatore
