Bug#884463: passenger: CVE-2017-16355: arbitrary file read

2019-03-16 Thread Salvatore Bonaccorso
Control: tags -1 + patch Attaching proposed debdiff for NMU, but I'm awaiting confirmation in #921767 to see if I miss something about the nginx module. Regards, Salvatore diff -Nru passenger-5.0.30/debian/changelog passenger-5.0.30/debian/changelog --- passenger-5.0.30/debian/changelog 2016-08

Bug#884463: passenger: CVE-2017-16355: arbitrary file read

2019-03-10 Thread Martin Chase
Hey, It looks like version 5.0.30 is not impacted by the CVE[1], and to the best of my abilities, I couldn't reproduce the insecure behavior. I didn't try to read through the source to see if a fix patch *might* still do something useful. Commit 4043718264095cde6623c2cbe8c644541036d7bf[2] does me

Bug#884463: passenger: CVE-2017-16355: arbitrary file read

2017-12-15 Thread Salvatore Bonaccorso
Source: passenger Version: 5.0.30-1 Severity: important Tags: patch security upstream fixed-upstrream Hi, the following vulnerability was published for passenger. CVE-2017-16355[0]: | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed | in Passenger Open Source 5.1.11 and Pas