CVSS 3.0
5.3 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2018-12615
Medium (5.3) in phusion passenger. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in passenger 5.3.2.
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- phusion:passenger
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4284-jfhc-f854 | RubyGems | passenger | <5.3.2 | 5.3.2 |