CVE-2014-1832
Insecure use of temporary files in Phusion passenger
EPSS 0.07%
Description
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
How to fix CVE-2014-1832
To remediate CVE-2014-1832, upgrade the affected package to a fixed version below.
- RubyGems/passenger—upgrade to 4.0.38 or later
Is CVE-2014-1832 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 4.0.37, < 4.0.38