CVE-2017-1000384
Security update for rubygem-passenger
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
What each source reports
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2017-1000384- Updated
- 2026-11-02
EUVDEUVD-2017-1543 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
EUVD-2017-1543- Updated
- 2026-11-03
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2017-1000384- Updated
- 2026-11-02
OSVSUSE-SU-2018:0262-1 No score
Security update for rubygem-passenger
This update for rubygem-passenger fixes several issues.
These security issues were fixed:
- CVE-2017-16355: When Passenger was running as root it was possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml (bsc#1073255).
- CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run with root permissions while the directory permissions of (parts of) its root dir allow modifications by non-root users (bsc#1068874).
- Record
SUSE-SU-2018:0262-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0309-1 No score
Security update for rubygem-passenger
This update for rubygem-passenger fixes the following issues:
Security issue fixed:
- CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run with root permissions while the directory permissions of (parts of) its root dir allow modifications by non-root users (bsc#1068874).
- Record
SUSE-SU-2018:0309-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-1000384 No score
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
- Record
UBUNTU-CVE-2017-1000384- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rubygem-passengerSUSE:Linux Enterprise Module for Containers 12 From an advisory covering 2 CVEs |
before 5.0.18-12.5.1 | 5.0.18-12.5.1 |
rubygem-passengerSUSE:Lifecycle Management Server 1.3 |
before 3.0.14-0.18.3.4 | 3.0.14-0.18.3.4 |
rubygem-passengerSUSE:Studio Onsite 1.3 |
before 3.0.14-0.18.3.4 | 3.0.14-0.18.3.4 |
rubygem-passengerSUSE:WebYast 1.3 |
before 3.0.14-0.18.3.4 | 3.0.14-0.18.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000384 has been rejected by its source and should not be treated as a live vulnerability, published December 15, 2017. Fixed in rubygem-passenger 3.0.14-0.18.3.4.