CVE-2018-12028
Last modified
CVE-2018-12028 is a vulnerability of currently unknown severity. An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.. EPSS estimates a 0.90% chance of exploitation in the next 30 days.
Description
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phusion | Passenger | >= 5.3.0, < 5.3.2 |
References
- https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
- https://security.gentoo.org/glsa/201807-02Third Party Advisory
- https://blog.phusion.nl/passenger-5-3-2Mitigation, Vendor Advisory
- https://security.gentoo.org/glsa/201807-02Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-12028?
How severe is CVE-2018-12028?
How do I fix CVE-2018-12028?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-12021Singularity 2.3.0 through 2.5.1 is affected by an incorrect …
- CVE-2018-12022An issue was discovered in FasterXML jackson-databind prior …7.5
- CVE-2018-12023An issue was discovered in FasterXML jackson-databind prior …
- CVE-2018-12025The transferFrom function of a smart contract implementation…
- CVE-2018-12026During the spawning of a malicious Passenger-managed applica…
- CVE-2018-12027An Insecure Permissions vulnerability in SpawningKit in Phus…
- CVE-2018-12029A race condition in the nginx module in Phusion Passenger 3.…
- CVE-2018-1203In Dell EMC Isilon OneFS, the compadmin is able to run tcpdu…
- CVE-2018-12030Chevereto Free before 1.0.13 has XSS.
- CVE-2018-12031Local file inclusion in Eaton Intelligent Power Manager v1.6…
- CVE-2018-12034In YARA 3.7.1 and prior, parsing a specially crafted compile…
- CVE-2018-12035In YARA 3.7.1 and prior, parsing a specially crafted compile…
Are you affected by CVE-2018-12028?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST