Catalogo CVE
CVE-2018-12029
passenger: CVE-2018-12029
- Gravità
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.28% · Oct 22, 2026
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | passenger | sid | 6.2.0+ds-1 | fixed |
| Debian | passenger | forky | 6.2.0+ds-1 | fixed |
| Debian | passenger | trixie | 6.0.26+ds-1.1 | fixed |
| Debian | passenger | bookworm | 6.0.17+ds-1 | fixed |
| Ubuntu | passenger | pro | 5.0.7-3 | vulnerable |
| Ubuntu | passenger | pro | 5.0.22-1 | vulnerable |
| Ubuntu | passenger | pro | 5.0.22-1build1 | vulnerable |
| Ubuntu | passenger | pro | 5.0.22-1build2 | vulnerable |
| Ubuntu | passenger | pro | 5.0.27-2 | vulnerable |
| Ubuntu | passenger | pro | 5.0.27-2ubuntu0.1~esm1 | fixed |
| Ubuntu | passenger | 18.04 | 5.0.30-1 | vulnerable |
| Ubuntu | passenger | 18.04 | 5.0.30-1build1 | vulnerable |
| Ubuntu | passenger | 18.04 | 5.0.30-1build2 | vulnerable |
| Ubuntu | passenger | 18.04 | 5.0.30-1+deb9u1build0.18.04.1 | fixed |
| Suse | rubygem-passenger | linux enterprise module for containers 12 | 5.0.18-12.9.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | passenger | source | sid | 5.0.30-1.1 | unimportant | Not reported | [921767] |
| Debian | passenger | source | forky | 5.0.30-1.1 | unimportant | Not reported | [921767] |
| Debian | passenger | source | trixie | 5.0.30-1.1 | unimportant | Not reported | [921767] |
| Debian | passenger | source | bookworm | 5.0.30-1.1 | unimportant | Not reported | [921767] |
| Ubuntu | passenger | deb | pro | 5.0.27-2ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2018-12029 | Not reported |
| Ubuntu | passenger | deb | 18.04 | 5.0.30-1+deb9u1build0.18.04.1 | Not reported | UBUNTU-CVE-2018-12029 | Not reported |
| Suse | rubygem-passenger | rpm | linux enterprise module for containers 12 | 5.0.18-12.9.1 | Not reported | SUSE-SU-2018:2039-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libapache2-mod-passenger]Corretta
Pacchetto sorgente: [passenger]
Dettagli (2)
6.0.17+ds-1· amd64 · bookwormCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · bookworm; dsa · passenger · debian · 12
6.0.17+ds-1· arm64 · bookwormCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · bookworm; dsa · passenger · debian · 12
- [passenger]Corretta
Dettagli (2)
6.0.17+ds-1· amd64 · bookwormCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · bookworm; dsa · passenger · debian · 12
6.0.17+ds-1· arm64 · bookwormCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · bookworm; dsa · passenger · debian · 12
[Debian 13 (Trixie)]
- [libapache2-mod-passenger]Corretta
Pacchetto sorgente: [passenger]
Dettagli (2)
6.0.26+ds-1.1· amd64 · trixieCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · 13
6.0.26+ds-1.1· arm64 · trixieCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · 13
- [passenger]Corretta
Dettagli (2)
6.0.26+ds-1.1· amd64 · trixieCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · 13
6.0.26+ds-1.1· arm64 · trixieCorretta · Corretta:
5.0.30-1.1dsa · passenger · debian · 13
Osservato: