{"id":"CVE-2014-1832","published":"2015-02-19T15:00:00Z","modified":"2024-08-06T09:50:11Z","title":"Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1)…","vendor":null,"product":null,"tier":"tail","description":{"text":"Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00371,"percentile":0.3089,"provenance":"source"},"cwes":[],"references":[{"url":"http://openwall.com/lists/oss-security/2014/01/29/6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736958","tags":["x_refsource_CONFIRM"]},{"url":"http://openwall.com/lists/oss-security/2014/01/30/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058992","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149032.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0","tags":["x_refsource_CONFIRM"]}],"priority":{"score":6.2,"factors":[{"name":"EPSS percentile","points":6.18}]},"affected":[{"ecosystem":"RubyGems","package":"passenger","vulnerableRanges":[">=4.0.37, <4.0.38"],"patched":["4.0.38"],"from":["GHSA-qw8w-2xcp-xg59"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0670","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-passenger-cve-2013-4136","parents":[{"from":"CVE-2014-1831","to":"CVE-2014-1832","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.","from":"CVE.org","in":"CVE-2014-1832"},{"kind":"same-code","provenance":"machine","files":["ext/common/ServerInstanceDir.h","ext/common/Utils.cpp","ext/common/Utils.h"],"commits":["https://github.com/phusion/passenger/commit/34b1087870c2bf85ebfd72c30b78577e10ab9744","https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0"],"basis":"shared function","functions":["ServerInstanceDir","fileExists","getFileType"]},{"kind":"similar","provenance":"machine","score":0.93,"basis":"same package + description similarity"}]},{"from":"CVE-2013-4136","to":"CVE-2014-1832","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["ext/common/ServerInstanceDir.h"],"commits":["https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","https://github.com/phusion/passenger/commit/94428057c602da3d6d34ef75c78091066ecac5c0"],"basis":"shared function","functions":["ServerInstanceDir"]}]}]}}