Security update for rubygem-passenger SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0042-1 Final 1 1 2016-01-07T09:33:34Z current 2016-01-07T09:33:34Z 2016-01-07T09:33:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-passenger This update fixes the following security issues: - CVE-2015-7519: Passenger is not filtering environment like apache is doing (bnc#956281) - CVE-2013-4136: Fixed security issue Passenger would reuse existing server instance directories (temporary directories) which could cause Passenger to remove or overwrite files belonging to other instances. Solution: If the server instance directory already exists, it will now be removed first in order get correct directory permissions. If the directory still exists after removal, Phusion Passenger aborts to avoid writing to a directory with unexpected permissions.(bnc#919726) - CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleslms13-rubygem-passenger-12303,slestso13-rubygem-passenger-12303,slewyst13-rubygem-passenger-12303 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/ Link for SUSE-SU-2016:0042-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001784.html E-Mail link for SUSE-SU-2016:0042-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/828005 SUSE Bug 828005 https://bugzilla.suse.com/919726 SUSE Bug 919726 https://bugzilla.suse.com/956281 SUSE Bug 956281 https://www.suse.com/security/cve/CVE-2013-2119/ SUSE CVE CVE-2013-2119 page https://www.suse.com/security/cve/CVE-2013-4136/ SUSE CVE CVE-2013-4136 page https://www.suse.com/security/cve/CVE-2015-7519/ SUSE CVE CVE-2015-7519 page SUSE Lifecycle Management Server 1.3 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 rubygem-passenger-3.0.14-0.14.1 rubygem-passenger-apache2-3.0.14-0.14.1 rubygem-passenger-nginx-3.0.14-0.14.1 rubygem-passenger-3.0.14-0.14.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-apache2-3.0.14-0.14.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-nginx-3.0.14-0.14.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-passenger-3.0.14-0.14.1 as a component of SUSE Studio Onsite 1.3 rubygem-passenger-nginx-3.0.14-0.14.1 as a component of SUSE Studio Onsite 1.3 rubygem-passenger-3.0.14-0.14.1 as a component of SUSE WebYast 1.3 rubygem-passenger-nginx-3.0.14-0.14.1 as a component of SUSE WebYast 1.3 Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem. CVE-2013-2119 SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/ https://www.suse.com/security/cve/CVE-2013-2119.html CVE-2013-2119 https://bugzilla.suse.com/828005 SUSE Bug 828005 https://bugzilla.suse.com/919726 SUSE Bug 919726 ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/. CVE-2013-4136 SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/ https://www.suse.com/security/cve/CVE-2013-4136.html CVE-2013-4136 https://bugzilla.suse.com/624673 SUSE Bug 624673 https://bugzilla.suse.com/919726 SUSE Bug 919726 agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header. CVE-2015-7519 SUSE Lifecycle Management Server 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-apache2-3.0.14-0.14.1 SUSE Lifecycle Management Server 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE Studio Onsite 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-3.0.14-0.14.1 SUSE WebYast 1.3:rubygem-passenger-nginx-3.0.14-0.14.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/ https://www.suse.com/security/cve/CVE-2015-7519.html CVE-2015-7519 https://bugzilla.suse.com/956281 SUSE Bug 956281