RubyGems/passenger CVE-2016-10345: high 7.8, EPSS 0.46%

Phusion Passenger uses a known /tmp filename

Action: Upgrade passenger to 5.1.0 or later.

bundle update passenger

Affected

Fixed versions

Sources

• osv: GHSA-cqxw-3p7v-p9gr
• https://nvd.nist.gov/vuln/detail/CVE-2016-10345
• https://github.com/phusion/passenger/commit/e5b4b0824d6b648525b4bf63d9fa37e5beeae441
• https://blog.phusion.nl/2017/01/10/passenger-5-1-1
• https://github.com/advisories/GHSA-cqxw-3p7v-p9gr
• https://github.com/phusion/passenger
• https://github.com/phusion/passenger/blob/stable-5.1/CHANGELOG
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2016-10345.yml

CVE-2016-10345 · published 2018-08-21T17:08:03Z · modified 2024-12-08T05:22:56.094321Z · JSON