{"id":"CVE-2013-2119","aliases":["EUVD-2017-0208","GHSA-9qj7-jvg4-qr2x","MGASA-2013-0205","RHSA-2013:1136","SUSE-SU-2016:0042-1","UBUNTU-CVE-2013-2119","openSUSE-SU-2024:11341-1"],"status":"published","title":"Phusion Passenger Denial of Service","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.","severity":{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00397,"percentile":0.34355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-377"],"published":"2013-07-09T18:27:49Z","modified":"2026-06-16T23:52:46Z","fixes":[{"ecosystem":"RubyGems","package":"passenger","fixed_in":["3.0.21","4.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:3","package":"rubygem-passenger","fixed_in":["3.0.21-2.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.5"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.2","2.1.3","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","3.0.0","3.0.0.pre1","3.0.0.pre2","3.0.0.pre3","3.0.0.pre4","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.17","3.0.18","3.0.19","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1"},{"fixed":"4.0.5"}]}],"versions":["4.0.1","4.0.2","4.0.3","4.0.4"]},{"source":"osv","ecosystem":"Mageia:3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-2.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"mod_passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-mod_passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-native-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-file-tail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-file-tail-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-native-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-spruz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-spruz-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3}],"products":[{"vendor":"phusion","product":"passenger"},{"vendor":"redhat","product":"openshift"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892813","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2119","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9qj7-jvg4-qr2x","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1136","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2119","tags":["web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-2119.yml","tags":["web"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released","tags":["web"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2013-0205.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-June/108443.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10728","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10497","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985633","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1136.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2119","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4136","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/828005","tags":["report"]},{"url":"https://bugzilla.suse.com/919726","tags":["report"]},{"url":"https://bugzilla.suse.com/956281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7519","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2119","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12029","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2119","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.","status":"published","published":"2014-01-02T21:00:00Z","modified":"2024-08-06T15:27:40.872Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2017-0208","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.","status":"published","published":"2014-01-02T21:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-9qj7-jvg4-qr2x","title":"Phusion Passenger Denial of Service","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in `/tmp/` before it is used by the gem.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-07-05T18:50:18Z","cwes":["CWE-377"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2013-2119","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.","status":"published","published":"2014-01-03T18:54:11.35Z","modified":"2026-06-16T23:52:46.913Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"GHSA-9qj7-jvg4-qr2x","title":"Phusion Passenger Denial of Service","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in `/tmp/` before it is used by the gem.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-08T05:23:50.219453Z","cwes":["CWE-377"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"MGASA-2013-0205","title":"Updated rubygem-passenger package fixes CVE-2013-2119","description":"Phusion Passengers code did not always create temporary files and directories\nin a secure manner. Temporary files and directories were sometimes created\nwith a predictable filename. A local attacker can pre-create temporary files,\nresulting in a denial of service. In addition, this vulnerability allows a\nlocal attacker to run arbitrary code as another user, by hijacking temporary\nfiles (CVE-2013-2119).\n\nThe rubygem-passenger package has been upgraded to version 3.0.21, which fixes\nthis issue, as well as many others although at the moment has further issues \nwhich will be fixed with another update (mga#10728).\n","status":"published","published":"2013-07-09T18:27:49Z","modified":"2026-04-16T06:25:09.545659398Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:11341-1","title":"ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:43.862306Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"RHSA-2013:1136","title":"Red Hat Security Advisory: rubygem-passenger security update","status":"published","published":"2024-09-13T08:25:57Z","modified":"2026-03-23T04:43:01.919467Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2016:0042-1","title":"Security update for rubygem-passenger","description":"\n\nThis update fixes the following security issues:\n\n- CVE-2015-7519: Passenger is not filtering\n  environment like apache is doing (bnc#956281)\n\n- CVE-2013-4136: Fixed security issue   Passenger would reuse existing server instance directories\n  (temporary directories) which could cause Passenger to remove or\n  overwrite files belonging to other instances. Solution:\n  If the server instance directory already exists, it will now be\n  removed first in order get correct directory permissions. If the\n  directory still exists after removal, Phusion Passenger aborts to\n  avoid writing to a directory with unexpected permissions.(bnc#919726) \n\n- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)  ","status":"published","published":"2016-01-07T09:33:34Z","modified":"2026-02-04T03:58:39.11451Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2013-2119","description":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem.","status":"withdrawn","published":"2014-01-03T18:54:00Z","modified":"2025-07-16T07:31:14.54592Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}