CVE-2013-4136
insecure temporary directory usage in passenger
EPSS 0.04%
Description
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
How to fix CVE-2013-4136
To remediate CVE-2013-4136, upgrade the affected package to a fixed version below.
- Debian/passenger—upgrade to 3.0.13debian-1.2 or later
- RubyGems/passenger—upgrade to 4.0.6 or later
Is CVE-2013-4136 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 3.0.13debian-1.2
- from 0, < 4.0.6