Description

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.

Remediation

References

CVE-2018-12615

Related Vulnerabilities

Oracle Database Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2018-10237)

WordPress Plugin Subscribe Form Remote Command Execution (1.1)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-47272)

PHP Improper Input Validation Vulnerability (CVE-2020-7071)

WordPress Plugin Print My Blog-Print, PDF, & eBook Converter Cross-Site Request Forgery (3.4.1)

Severity

Medium

Classification

CVE-2018-12615 CWE-732 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities