insecure temporary directory usage in passenger (GHSA-w6rc-q387-vpgq)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-4136
Severity: MODERATE · CWE: CWE-59

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Affected packages:
package: ecosystem: RubyGems
name: passenger
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.6