1. Ubuntu Security Notices
  2. USN-5261-1

USN-5261-1: Phusion Passenger vulnerabilities

Publication date

1 February 2022

Overview

Several security issues were fixed in Phusion Passenger.

Releases

Packages

Details

It was discovered that Phusion Passenger incorrectly handled a file path in
the application root folder. An attacker could possibly use this issue to
read arbitrary files. (CVE-2017-16355)

It was discovered that Phusion Passenger had a race condition in the nginx
module that could be used to perform a symlink attack. An attacker could
possibly use this issue to escalate privileges. (CVE-2018-12029)

It was discovered that Phusion Passenger incorrectly handled a file path in
the application root folder. An attacker could possibly use this issue to
read arbitrary files. (CVE-2017-16355)

It was discovered that Phusion Passenger had a race condition in the nginx
module that could be used to perform a symlink attack. An attacker could
possibly use this issue to escalate privileges. (CVE-2018-12029)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 xenial passenger –  5.0.27-2ubuntu0.1~esm1  
libapache2-mod-passenger –  5.0.27-2ubuntu0.1~esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›