A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passe...
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-12029 passenger Fixed in: 5.0.30-1.1
Original description The description as published by the source.
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory blog.phusion.nl
- advisory lists.debian.org
- advisory pulsesecurity.co.nz
- advisory security.gentoo.org