{"id":"CVE-2018-12029","aliases":["DEBIAN-CVE-2018-12029","DLA-1399-1","EUVD-2022-4382","GHSA-jjcj-fgfm-9g9r","SUSE-SU-2018:2039-1","UBUNTU-CVE-2018-12029","USN-5261-1","openSUSE-SU-2024:11341-1"],"status":"published","title":"Phusion Passenger Race Condition Allows Privilege Escalation","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00274,"percentile":0.19903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2018-06-17T20:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"RubyGems","package":"passenger","fixed_in":["5.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"passenger","fixed_in":["5.0.30-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"passenger","fixed_in":["5.0.30-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"passenger","fixed_in":["5.0.30-1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-passenger","fixed_in":["5.0.18-12.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"passenger","fixed_in":["5.0.27-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"passenger","fixed_in":["5.0.30-1+deb9u1build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.3.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.30-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.30-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.30-1.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.53-1+deb8u1"}]}],"versions":["4.0.53-1"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.3.2"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.17","3.0.18","3.0.19","3.0.2","3.0.21","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.9.1.beta","3.9.2.beta","4.0.0.rc4","4.0.0.rc6","4.0.1","4.0.10","4.0.13","4.0.14","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.29","4.0.3","4.0.30","4.0.31","4.0.32","4.0.33","4.0.34","4.0.35","4.0.36","4.0.37","4.0.38","4.0.39","4.0.4","4.0.40","4.0.41","4.0.42","4.0.43","4.0.44","4.0.45","4.0.46","4.0.48","4.0.49","4.0.5","4.0.50","4.0.51","4.0.52","4.0.53","4.0.55","4.0.56","4.0.57","4.0.58","4.0.59","4.0.6","4.0.60","4.0.7","4.0.8","5.0.0.beta1","5.0.0.beta2","5.0.0.beta3","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.10","5.0.11","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.10","5.1.11","5.1.12","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2.0","5.2.1","5.2.2","5.2.3","5.3.0","5.3.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"rubygem-passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.18-12.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.27-2ubuntu0.1~esm1"}]}],"versions":["5.0.7-3","5.0.22-1","5.0.22-1build1","5.0.22-1build2","5.0.27-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.30-1+deb9u1build0.18.04.1"}]}],"versions":["5.0.30-1","5.0.30-1build1","5.0.30-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.27-2ubuntu0.1~esm1"}]}],"versions":["5.0.7-3","5.0.22-1","5.0.22-1build1","5.0.22-1build2","5.0.27-2"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"phusion","product":"passenger"}],"references":[{"url":"https://blog.phusion.nl/passenger-5-3-2","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://security.gentoo.org/glsa/201807-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://pulsesecurity.co.nz/advisories/phusion-passenger-priv-esc","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12029","tags":["advisory"]},{"url":"https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes/","tags":["report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12029.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jjcj-fgfm-9g9r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12029","tags":["advisory"]},{"url":"https://blog.phusion.nl/2018/06/12/passenger-5-3-2-various-security-fixes","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12029","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12029","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5261-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-16355","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12026","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12029","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:00:00Z","modified":"2024-08-05T08:24:03.642Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2022-4382","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:00:00Z","modified":"2024-08-05T08:24:03Z","updated_at":"2026-11-03T02:39:53.575925Z"}],"ghsa":[{"id":"GHSA-jjcj-fgfm-9g9r","title":"Phusion Passenger Race Condition Allows Privilege Escalation","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2022-05-14T01:27:14Z","modified":"2023-07-03T21:46:31Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2018-12029","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:29:00.493Z","modified":"2026-06-17T01:37:01.963Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12029","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:29:00.493Z","modified":"2026-10-24T10:30:49.662935683Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12029","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:29:00.493Z","modified":"2026-10-23T18:03:53.601766067Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"GHSA-jjcj-fgfm-9g9r","title":"Phusion Passenger Race Condition Allows Privilege Escalation","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2022-05-14T01:27:14Z","modified":"2024-02-20T05:28:37.711015Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"UBUNTU-CVE-2018-12029","description":"A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.","status":"published","published":"2018-06-17T20:29:00Z","modified":"2026-02-04T04:10:24.567017Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1399-1","title":"ruby-passenger - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:58.574541Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"openSUSE-SU-2024:11341-1","title":"ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:43.862306Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:2039-1","title":"Security update for rubygem-passenger","description":"This update for rubygem-passenger fixes the following issue:\n\nThe following security vulnerability was addressed:\n\n- CVE-2018-12029: Fixed a file system access race condition in the chown\n  command, which allowed for local privilege escalation and affects the Nginx\n  module (bsc#1097663).\n","status":"published","published":"2018-07-23T08:43:57Z","modified":"2026-02-04T02:24:30.599764Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-5261-1","title":"passenger vulnerabilities","description":"It was discovered that Phusion Passenger incorrectly handled a file path in\nthe application root folder. An attacker could possibly use this issue to\nread arbitrary files. (CVE-2017-16355)\n\nIt was discovered that Phusion Passenger had a race condition in the nginx\nmodule that could be used to perform a symlink attack. An attacker could\npossibly use this issue to escalate privileges. (CVE-2018-12029)\n","status":"published","published":"2022-02-01T17:55:14Z","modified":"2026-06-25T13:30:14.480380703Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}