Phusion Passenger Denial of Service (GHSA-9qj7-jvg4-qr2x)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-2119
Severity: MODERATE · CWE: CWE-377

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in `/tmp/` before it is used by the gem.

Affected packages:
package: ecosystem: RubyGems
name: passenger
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.21
package: ecosystem: RubyGems
name: passenger
ranges: type: ECOSYSTEM
events: introduced: 4.0.1
fixed: 4.0.5