[Secure-testing-team] Bug#884463: passenger: CVE-2017-16355: arbitrary file read

[Salvatore Bonaccorso]

Source: passenger
Version: 5.0.30-1
Severity: important
Tags: patch security upstream fixed-upstrream

Hi,

the following vulnerability was published for passenger.

CVE-2017-16355[0]:
| In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed
| in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if
| Passenger is running as root, it is possible to list the contents of
| arbitrary files on a system by symlinking a file named REVISION from
| the application root folder to a file of choice and querying
| passenger-status --show=xml.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16355
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16355
[1] https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/
[2] https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf

Regards,
Salvatore