CVE-2018-12028
Last modified
CVE-2018-12028 is a vulnerability of currently unknown severity. An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.. EPSS estimates a 0.90% chance of exploitation in the next 30 days.
Description
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phusion | Passenger | >= 5.3.0, < 5.3.2 |
References
- https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
- https://security.gentoo.org/glsa/201807-02Third Party Advisory
- https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
- https://security.gentoo.org/glsa/201807-02Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-12028?
How severe is CVE-2018-12028?
How do I fix CVE-2018-12028?
Are you affected by CVE-2018-12028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST