Debian Security Advisory(Debian安全报告) DSA-4415-1 passenger security update

Debian Security Advisory(Debian安全报告) DSA-4415-1  passenger security update

Package ： passenger

CVE ID ： CVE-2017-16355

Debian Bug ： 884463

　　在web应用程序服务器passenger中发现了一个任意文件读取漏洞。允许将应用程序部署到passenger的本地用户可以利用这个缺陷，从REVISION文件创建到系统上任意文件的符号链接，并通过passenger-status显示其内容。

　　这个问题在5.0.30-1+deb9u1版本中得到了修复。

　　passenger的详细安全情况请参考其安全跟踪页面:https://securtracker.debian.org/tracker/passenger

-------------------------

Debian Security Advisory DSA-4415-1 passenger security update

Package        : passenger
CVE ID         : CVE-2017-16355
Debian Bug     : 884463

An arbitrary file read vulnerability was discovered in passenger, a web application server. A local user allowed to deploy an application to passenger, can take advantage of this flaw by creating a symlink from the REVISION file to an arbitrary file on the system and have its content displayed through passenger-status.

This problem has been fixed in version 5.0.30-1+deb9u1.

For the detailed security status of passenger please refer to its security tracker page at: https://security-tracker.debian.org/tracker/passenger