{"action":"Upgrade passenger to 4.0.60 or later.","affected":[{"fixed":"4.0.60","introduced":"0"},{"fixed":"5.0.22","introduced":"5.0.0"}],"component":"passenger","cve_ids":["CVE-2015-7519"],"ecosystem":"RubyGems","epss":0.02364,"exploited":false,"fixed_versions":["4.0.60","5.0.22"],"ghsa_id":"GHSA-fxwv-953p-7qpf","id":"tcs_01M5KEK6816DKSC68FNT3156XJ","modified_at":"2024-02-22T05:33:44.982602Z","published_at":"2018-10-10T17:29:13Z","references":["https://osv.dev/vulnerability/GHSA-fxwv-953p-7qpf","https://nvd.nist.gov/vuln/detail/CVE-2015-7519","https://github.com/phusion/passenger/commit/ddb8ecc4ebf260e4967f57f271d4f5761abeac3e","https://blog.phusion.nl/2015/12/07/cve-2015-7519","https://bugzilla.suse.com/show_bug.cgi?id=956281","https://github.com/advisories/GHSA-fxwv-953p-7qpf","https://github.com/phusion/passenger","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2015-7519.yml","https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html","https://web.archive.org/web/20220327073056/https://www.puppet.com/security/cve/passenger-dec-2015-security-fixes","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00024.html","http://www.openwall.com/lists/oss-security/2015/12/07/1","http://www.openwall.com/lists/oss-security/2015/12/07/2"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-fxwv-953p-7qpf","url":"https://osv.dev/vulnerability/GHSA-fxwv-953p-7qpf"}],"summary":"Phusion Passenger allows remote attackers to spoof headers"}