CVE-2018-12615
NONE EPSS 64.4%
Published Jun 21, 20188y ago · Modified Jun 17, 20262w ago
Published Jun 21, 2018 8y ago
Last Modified Jun 17, 2026 2w ago
Description
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
Threat Intelligence
EPSS Exploit Probability
64.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-732
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| phusion | passenger | * | <5.3.2 |
References 1
- github.com https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
Remediation
- github.com https://github.com/phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8