From ${URL} : https://bugzilla.novell.com/show_bug.cgi?id=804722 https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541 Quoting: There is a security issue regarding passenger that has been fixed in master. However, this does only apply if you deploy arbitrary untrusted apps on you server. Very unlikely for us but still I thought it was worth to inform you. It fixes a security issue, but unless you're on a shared environment it's not a grave issue. It allows an application process to delete an arbitrary file, even a file it does not have permi ssion to, but only during application startup (i.e. during evaluation of config.ru). Once the application is started, it cannot be exploited, so external visitors cannot influence this. If you deploy arbitrary untrusted apps on your server then this issue can be a problem. If all your apps are trusted (e.g. because your organization wrote) them then there's no problem.
This bug fix is only relevant to the passenger 4.x series, which are still in beta and which we do not have in the gentoo tree. This code is completely new related to the passenger 3.x versions we have in tree, and upstream did not add any fixes to the 3.x branch even though they are still actively maintaining it, so I assume that 3.x isn't vulnerable to this issue.
thanks, close invalid
