CVE-Katalog

CVE-2018-12028

passenger: CVE-2018-12028

[CVE-Katalog]

Schweregrad
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.90% · Oct 22, 2026

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpassengersid6.2.0+ds-1not affected
Debianpassengerforky6.2.0+ds-1not affected
Debianpassengertrixie6.0.26+ds-1.1not affected
Debianpassengerbookworm6.0.17+ds-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianpassengersourcesidNot affectedunimportantNot reportedNot reported
DebianpassengersourceforkyNot affectedunimportantNot reportedNot reported
DebianpassengersourcetrixieNot affectedunimportantNot reportedNot reported
DebianpassengersourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-passenger]Nicht betroffen

    Quellpaket: [passenger]

    Details (2)

    • 6.0.17+ds-1 · amd64 · bookworm

      Nicht betroffen

      dsa · passenger · debian · bookworm

    • 6.0.17+ds-1 · arm64 · bookworm

      Nicht betroffen

      dsa · passenger · debian · bookworm

  • [passenger]Nicht betroffen
    Details (2)

    • 6.0.17+ds-1 · amd64 · bookworm

      Nicht betroffen

      dsa · passenger · debian · bookworm

    • 6.0.17+ds-1 · arm64 · bookworm

      Nicht betroffen

      dsa · passenger · debian · bookworm

Beobachtet:

Referenzen

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]