Catalogo CVE

CVE-2018-12028

passenger: CVE-2018-12028

[Catalogo CVE]

Gravità
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.90% · Oct 22, 2026

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpassengersid6.2.0+ds-1not affected
Debianpassengerforky6.2.0+ds-1not affected
Debianpassengertrixie6.0.26+ds-1.1not affected
Debianpassengerbookworm6.0.17+ds-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianpassengersourcesidNot affectedunimportantNot reportedNot reported
DebianpassengersourceforkyNot affectedunimportantNot reportedNot reported
DebianpassengersourcetrixieNot affectedunimportantNot reportedNot reported
DebianpassengersourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-passenger]Non interessata

    Pacchetto sorgente: [passenger]

    Dettagli (2)

    • 6.0.17+ds-1 · amd64 · bookworm

      Non interessata

      dsa · passenger · debian · bookworm

    • 6.0.17+ds-1 · arm64 · bookworm

      Non interessata

      dsa · passenger · debian · bookworm

  • [passenger]Non interessata
    Dettagli (2)

    • 6.0.17+ds-1 · amd64 · bookworm

      Non interessata

      dsa · passenger · debian · bookworm

    • 6.0.17+ds-1 · arm64 · bookworm

      Non interessata

      dsa · passenger · debian · bookworm

Osservato:

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]