{"id":"CVE-2013-4136","aliases":["DEBIAN-CVE-2013-4136","EUVD-2017-0321","GHSA-w6rc-q387-vpgq","MGASA-2013-0253","RHSA-2013:1136","SUSE-SU-2016:0042-1","UBUNTU-CVE-2013-4136"],"status":"published","title":"insecure temporary directory usage in passenger","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00326,"percentile":0.25923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2013-08-22T18:01:03Z","modified":"2026-09-01T20:03:17Z","fixes":[{"ecosystem":"RubyGems","package":"passenger","fixed_in":["4.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"passenger","fixed_in":["3.0.13debian-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"passenger","fixed_in":["3.0.13debian-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"passenger","fixed_in":["3.0.13debian-1.2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"rubygem-passenger","fixed_in":["3.0.21-2.2.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13debian-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13debian-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13debian-1.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.2","2.1.3","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","3.0.0","3.0.0.pre1","3.0.0.pre2","3.0.0.pre3","3.0.0.pre4","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.17","3.0.18","3.0.19","3.0.2","3.0.21","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.9.1.beta","3.9.2.beta","4.0.0.rc4","4.0.0.rc6","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5"]},{"source":"osv","ecosystem":"Mageia:3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.21-2.2.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"mod_passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-mod_passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"ruby193-rubygem-passenger-native-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-file-tail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-file-tail-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-passenger-native-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.21-3.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-spruz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:1.2::el6","package":"rubygem-spruz-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.5-4.el6op"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3}],"products":[{"vendor":"phusion","product":"passenger"}],"references":[{"url":"https://github.com/phusion/passenger/blob/release-4.0.6/NEWS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://code.google.com/p/phusion-passenger/issues/detail?id=910","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/16/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4136","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w6rc-q387-vpgq","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-4136.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4136","tags":["advisory"]},{"url":"https://github.com/phusion/passenger","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0253.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-July/112716.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10890","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1136","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985633","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1136.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2119","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4136","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/828005","tags":["report"]},{"url":"https://bugzilla.suse.com/919726","tags":["report"]},{"url":"https://bugzilla.suse.com/956281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7519","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4136","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2013/07/15/2","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4136","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2013-09-30T19:00:00Z","modified":"2024-09-17T03:38:39.532Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2017-0321","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2013-09-30T19:00:00Z","modified":"2024-09-17T03:38:39Z","updated_at":"2026-11-03T00:28:29.877686Z"}],"ghsa":[{"id":"GHSA-w6rc-q387-vpgq","title":"insecure temporary directory usage in passenger","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-06-09T20:17:25Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2013-4136","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2013-09-30T21:55:07.223Z","modified":"2026-06-16T23:56:41.543Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"CVE-2013-4136","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2013-09-30T21:55:07Z","modified":"2026-04-16T06:15:20.073680684Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4136","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2013-09-30T21:55:07.223Z","modified":"2026-09-01T20:03:17.662104265Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"GHSA-w6rc-q387-vpgq","title":"insecure temporary directory usage in passenger","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-05T05:36:49.756916Z","cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"MGASA-2013-0253","title":"Updated rubygem-passenger package fixes CVE-2013-4136 \u0026 apache module","description":"Updated rubygem-passenger package fixes security vulnerability:\n\nIt was reported that Phusion Passenger would reuse existing server instance\ndirectories (temporary directories) which could cause Passenger to remove or\noverwrite files belonging to other instances (CVE-2013-4136).\n\nAdditionally, the package has been fixed so that the Apache module should load.\n","status":"published","published":"2013-08-22T18:01:03Z","modified":"2026-04-16T06:23:55.87442853Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1136","title":"Red Hat Security Advisory: rubygem-passenger security update","status":"published","published":"2024-09-13T08:25:57Z","modified":"2026-03-23T04:43:01.919467Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2016:0042-1","title":"Security update for rubygem-passenger","description":"\n\nThis update fixes the following security issues:\n\n- CVE-2015-7519: Passenger is not filtering\n  environment like apache is doing (bnc#956281)\n\n- CVE-2013-4136: Fixed security issue   Passenger would reuse existing server instance directories\n  (temporary directories) which could cause Passenger to remove or\n  overwrite files belonging to other instances. Solution:\n  If the server instance directory already exists, it will now be\n  removed first in order get correct directory permissions. If the\n  directory still exists after removal, Phusion Passenger aborts to\n  avoid writing to a directory with unexpected permissions.(bnc#919726) \n\n- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)  ","status":"published","published":"2016-01-07T09:33:34Z","modified":"2026-02-04T03:58:39.11451Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2013-4136","description":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.","status":"withdrawn","published":"2013-09-30T21:55:00Z","modified":"2025-07-16T07:17:08.227716Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}