CVE-2013-2119

描述

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in `/tmp/` before it is used by the gem.

如何修補 CVE-2013-2119

要修補 CVE-2013-2119,請將受影響套件升級到下列已修補版本。

• RubyGems/passenger—升級至 3.0.21 或更新版本

CVE-2013-2119 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.0.21

參考連結(9)

• ADVISORYgithub.com/advisories/GHSA-9qj7-jvg4-qr2x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-2119
• WEBblog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released
• WEBblog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released
• WEB