{"id":"CVE-2015-7519","aliases":["DEBIAN-CVE-2015-7519","DLA-1399-1","DLA-394-1","EUVD-2018-0595","GHSA-fxwv-953p-7qpf","SUSE-SU-2015:2337-1","SUSE-SU-2016:0042-1","UBUNTU-CVE-2015-7519","openSUSE-SU-2024:11341-1"],"status":"published","title":"Phusion Passenger allows remote attackers to spoof headers","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","severity":{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02364,"percentile":0.83888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-12-21T19:06:59Z","modified":"2026-09-09T07:01:14Z","fixes":[{"ecosystem":"RubyGems","package":"passenger","fixed_in":["4.0.60","5.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"passenger","fixed_in":["5.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"passenger","fixed_in":["5.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"passenger","fixed_in":["5.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"passenger","fixed_in":["2.2.11debian-2+deb6u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-passenger","fixed_in":["5.0.18-6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.60"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.22"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.22-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.53-1+deb8u1"}]}],"versions":["4.0.53-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:6.0","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11debian-2+deb6u1"}]}],"versions":["2.2.11debian-2"]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.60"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.2","2.1.3","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","3.0.0","3.0.0.pre1","3.0.0.pre2","3.0.0.pre3","3.0.0.pre4","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.17","3.0.18","3.0.19","3.0.2","3.0.21","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.9.1.beta","3.9.2.beta","4.0.0.rc4","4.0.0.rc6","4.0.1","4.0.10","4.0.13","4.0.14","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.29","4.0.3","4.0.30","4.0.31","4.0.32","4.0.33","4.0.34","4.0.35","4.0.36","4.0.37","4.0.38","4.0.39","4.0.4","4.0.40","4.0.41","4.0.42","4.0.43","4.0.44","4.0.45","4.0.46","4.0.48","4.0.49","4.0.5","4.0.50","4.0.51","4.0.52","4.0.53","4.0.55","4.0.56","4.0.57","4.0.58","4.0.59","4.0.6","4.0.7","4.0.8"]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.22"}]}],"versions":["5.0.1","5.0.10","5.0.11","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.18-6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.14.1"}]}],"bundled":3}],"products":[{"vendor":"phusionpassenger","product":"phusion_passenger"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/phusion/passenger/commit/ddb8ecc4ebf260e4967f57f271d4f5761abeac3e","tags":["x_refsource_CONFIRM","x_transferred","fix","web","report"]},{"url":"https://blog.phusion.nl/2015/12/07/cve-2015-7519/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://puppet.com/security/cve/passenger-dec-2015-security-fixes","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/07/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=956281","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/07/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7519","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fxwv-953p-7qpf","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2015-7519.yml","tags":["web"]},{"url":"https://web.archive.org/web/20220327073056/https://www.puppet.com/security/cve/passenger-dec-2015-security-fixes","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-7519","tags":["advisory"]},{"url":"https://blog.phusion.nl/2015/12/07/cve-2015-7519","tags":["web"]},{"url":"https://github.com/phusion/passenger","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20152337-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/956281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7519","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160042-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/828005","tags":["report"]},{"url":"https://bugzilla.suse.com/919726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4136","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-7519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7519","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12029","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-7519","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"published","published":"2016-01-08T19:00:00Z","modified":"2024-08-06T07:51:28.493Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2018-0595","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"published","published":"2016-01-08T19:00:00Z","modified":"2024-08-06T07:51:28Z","updated_at":"2026-11-03T02:21:52.097705Z"}],"ghsa":[{"id":"GHSA-fxwv-953p-7qpf","title":"Phusion Passenger allows remote attackers to spoof headers","description":"`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.","status":"published","published":"2018-10-10T17:29:13Z","modified":"2023-07-05T18:39:03Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2015-7519","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"published","published":"2016-01-08T19:59:05.6Z","modified":"2026-06-17T00:32:41.323Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-7519","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"published","published":"2016-01-08T19:59:05Z","modified":"2026-04-10T03:46:27.692178Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-7519","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"published","published":"2016-01-08T19:59:05.6Z","modified":"2026-09-09T07:01:14.212471928Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-fxwv-953p-7qpf","title":"Phusion Passenger allows remote attackers to spoof headers","description":"`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.","status":"published","published":"2018-10-10T17:29:13Z","modified":"2024-02-22T05:33:44.982602Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2015-7519","description":"agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.","status":"withdrawn","published":"2016-01-08T19:59:00Z","modified":"2025-07-16T06:46:58.06884Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DLA-1399-1","title":"ruby-passenger - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:58.574541Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-394-1","title":"passenger - security update","status":"published","published":"2016-01-18T00:00:00Z","modified":"2026-03-09T01:20:36.914682Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:11341-1","title":"ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:43.862306Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2015:2337-1","title":"Security update for rubygem-passenger","description":"\nThis update for rubygem-passenger fixes the following issues: \n\n- CVE-2015-7519: rubygem-passenger was not filtering the environment like apache is doing, allowing injection\nof environment variables (bsc#956281)\n","status":"published","published":"2015-12-21T19:06:59Z","modified":"2026-02-04T02:39:25.126588Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0042-1","title":"Security update for rubygem-passenger","description":"\n\nThis update fixes the following security issues:\n\n- CVE-2015-7519: Passenger is not filtering\n  environment like apache is doing (bnc#956281)\n\n- CVE-2013-4136: Fixed security issue   Passenger would reuse existing server instance directories\n  (temporary directories) which could cause Passenger to remove or\n  overwrite files belonging to other instances. Solution:\n  If the server instance directory already exists, it will now be\n  removed first in order get correct directory permissions. If the\n  directory still exists after removal, Phusion Passenger aborts to\n  avoid writing to a directory with unexpected permissions.(bnc#919726) \n\n- CVE-2013-2119: Fixed security issue related with incorrect temporary file usage (bnc#828005)  ","status":"published","published":"2016-01-07T09:33:34Z","modified":"2026-02-04T03:58:39.11451Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}