CVE-2018-12028

NameCVE-2018-12028
DescriptionAn Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
passenger (PTS)stretch (security), stretch (lts), stretch5.0.30-1+deb9u1fixed
buster5.0.30-1.1fixed
bullseye5.0.30-1.2+deb11u1fixed
bookworm6.0.17+ds-1fixed
sid, trixie6.0.20+ds-1fixed
ruby-passenger (PTS)jessie, jessie (lts)4.0.53-1+deb8u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
passengersource(unstable)(not affected)
ruby-passengersource(unstable)(not affected)

Notes

- passenger <not-affected> (Introduced in 5.3.0 with major refactoring of SpawningKit)
- ruby-passenger <not-affected> (Introduced in 5.3.0 with major refactoring of SpawningKit)
https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/

Search for package or bug name: Reporting problems