What is GHSA-4284-jfhc-f854?

GHSA-4284-jfhc-f854 is a security advisory published by GitHub Security Advisories with Medium severity. Phusion Passenger incorrect permission assignment

Which CVE IDs does GHSA-4284-jfhc-f854 cover?

GHSA-4284-jfhc-f854 covers the following CVE IDs: CVE-2018-12615. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4284-jfhc-f854?

GHSA-4284-jfhc-f854 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4284-jfhc-f854?

GHSA-4284-jfhc-f854 affects 1 product, including: rubygems/passenger:\u003c 5.3.2.

GHSA-4284-jfhc-f854MediumCVSS 5.3

Phusion Passenger incorrect permission assignment

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-12615 →

📋 Description

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

🎯 Affected products1

rubygems/passenger:< 5.3.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-12615
https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12615.yml
https://github.com/advisories/GHSA-4284-jfhc-f854