Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2015:2337-1

Опубликовано: 21 дек. 2015
Источник: suse-cvrf

Описание

Security update for rubygem-passenger

This update for rubygem-passenger fixes the following issues:

  • CVE-2015-7519: rubygem-passenger was not filtering the environment like apache is doing, allowing injection of environment variables (bsc#956281)

Список пакетов

SUSE Linux Enterprise Module for Containers 12
ruby2.1-rubygem-passenger-5.0.18-6.1
rubygem-passenger-5.0.18-6.1
rubygem-passenger-apache2-5.0.18-6.1

Ссылки

Описание

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 12:ruby2.1-rubygem-passenger-5.0.18-6.1
SUSE Linux Enterprise Module for Containers 12:rubygem-passenger-5.0.18-6.1
SUSE Linux Enterprise Module for Containers 12:rubygem-passenger-apache2-5.0.18-6.1
Ссылки