Hi,
https://bugzilla.novell.com/show_bug.cgi?id=804722
https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541
Quoting:
There is a security issue regarding passenger that has been fixed in
master. However, this does only apply if you deploy arbitrary
untrusted apps on you server. Very unlikely for us but still I thought
it was worth to inform you.
It fixes a security issue, but unless you're on a shared environment it's not a
grave issue. It allows an application process to delete an arbitrary file, even
a file it does not have permi
ssion to, but only during application startup (i.e. during evaluation of
config.ru). Once the application is started, it cannot be exploited, so
external visitors cannot influence this. If
you deploy arbitrary untrusted apps on your server then this issue can be a
problem. If all your apps are trusted (e.g. because your organization wrote)
them then there's no problem.
Unquote
Ciao, Marcus Meissner
<meissner () suse de>
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information