{"id":"CVE-2017-1000384","aliases":["EUVD-2017-1543","SUSE-SU-2018:0262-1","SUSE-SU-2018:0309-1","UBUNTU-CVE-2017-1000384"],"status":"rejected","title":"Security update for rubygem-passenger","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-12-15T10:00:00Z","modified":"2026-02-04T04:18:38Z","fixes":[{"ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-passenger","fixed_in":["3.0.14-0.18.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-passenger","fixed_in":["3.0.14-0.18.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:WebYast 1.3","package":"rubygem-passenger","fixed_in":["3.0.14-0.18.3.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.18-12.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.18.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.18.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-0.18.3.4"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180262-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1068874","tags":["report"]},{"url":"https://bugzilla.suse.com/1073255","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16355","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180309-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-1000384","tags":["report"]},{"url":"https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/","tags":["report"]},{"url":"https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/11/21/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000384","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000384","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2017-12-15T10:00:00Z","modified":"2017-12-15T09:57:01Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1543","description":"DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2017-12-15T10:00:00Z","modified":"2017-12-15T09:57:01Z","updated_at":"2026-11-03T03:51:47.765487Z"}],"nvd":[{"id":"CVE-2017-1000384","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2017-12-15T10:29:00.21Z","modified":"2023-11-07T02:37:56.623Z","updated_at":"2026-11-02T14:04:10.156892Z"}],"osv":[{"id":"SUSE-SU-2018:0262-1","title":"Security update for rubygem-passenger","description":"This update for rubygem-passenger fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-16355: When Passenger was running as root it was possible to list\n  the contents of arbitrary files on a system by symlinking a file named REVISION\n  from the application root folder to a file of choice and querying\n  passenger-status --show=xml (bsc#1073255).\n- CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run\n  with root permissions while the directory permissions of (parts of) its root dir allow\n  modifications by non-root users (bsc#1068874).\n","status":"published","published":"2018-01-29T13:35:28Z","modified":"2026-02-04T04:18:38.986228Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0309-1","title":"Security update for rubygem-passenger","description":"This update for rubygem-passenger fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-1000384: Introduces a new check that logs a vulnerability warning if Passenger is run\n  with root permissions while the directory permissions of (parts of) its root dir allow\n  modifications by non-root users (bsc#1068874).\n","status":"published","published":"2018-01-30T15:35:39Z","modified":"2026-02-04T02:30:21.512944Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"UBUNTU-CVE-2017-1000384","description":"** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-16355. Reason: This candidate is a reservation duplicate of CVE-2017-16355. Notes: All CVE users should reference CVE-2017-16355 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"withdrawn","published":"2017-12-15T10:29:00Z","modified":"2025-07-08T14:32:17.03615Z","updated_at":"2026-11-02T15:54:13.729565Z"}]}}