RHSA-2013:1136Medium

Red Hat Security Advisory: rubygem-passenger security update

Published
August 5, 2013
Last Modified
February 27, 2026

🔗 CVE IDs covered (2)

CVE-2013-2119 →CVE-2013-4136 →

📋 Description

CVE-2013-2119 — rubygem-passenger: incorrect temporary file usage CVE-2013-4136 — rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories

🎯 Affected products46

  • RHOSE Infrastructure 1.2
  • Red Hat OpenShift Enterprise Node
  • mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-mod_passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-0:3.0.21-3.el6op.src as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-0:3.0.21-3.el6op.src as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-debuginfo-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-devel-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-doc-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-native-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • ruby193-rubygem-passenger-native-libs-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • rubygem-file-tail-0:1.0.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2
  • rubygem-file-tail-0:1.0.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node
  • rubygem-file-tail-0:1.0.5-4.el6op.src as a component of RHOSE Infrastructure 1.2
  • rubygem-file-tail-0:1.0.5-4.el6op.src as a component of Red Hat OpenShift Enterprise Node
  • rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch as a component of RHOSE Infrastructure 1.2
  • rubygem-file-tail-doc-0:1.0.5-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Node
  • rubygem-passenger-0:3.0.21-3.el6op.src as a component of RHOSE Infrastructure 1.2
  • rubygem-passenger-0:3.0.21-3.el6op.src as a component of Red Hat OpenShift Enterprise Node
  • rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of RHOSE Infrastructure 1.2
  • rubygem-passenger-0:3.0.21-3.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node
  • +16 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 Manual action is required for this update to take effect. In order for the updated passenger packages to be loaded by Ruby applications in the PaaS, the applications must be restarted with oo-admin-ctl-gears. One way to accomplish this is by running the following command, as a single line without the line break, on all OpenShift Nodes: for rubyapp in `ls -d /var/lib/openshift/*/ruby | cut -f5 -d/`; do oo-admin-ctl-gears restartgear $rubyapp; done If there are no Ruby applications on a Node it will simply fail with the message "No such file or directory". Another option is to run the following on all OpenShift Nodes; however, it will result in non-Ruby applications also being restarted: oo-admin-ctl-gears restartall (Note that without the manual action, if a user attempts to restart their Ruby application via the rhc command line, it will fail to start with a "Passenger could not be initialized..." error.)

🔗 References (5)