CVE-2014-8583 mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified...
MediumCVSS 6.9
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mod-wsgi(Debian:12) | < 4.2.7-1 | 4.2.7-1 |
| debian/mod-wsgi(Debian:13) | < 4.2.7-1 | 4.2.7-1 |
| debian/mod-wsgi(Debian:14) | < 4.2.7-1 | 4.2.7-1 |
| modwsgi mod wsgi | <= 4.2.4 | No fix listed |
References
- Debian Security Tracker CVE-2014-8583 vendor-advisory
- advisories.mageia.org
- openSUSE-SU-2014:1590 vendor-advisory
- modwsgi.readthedocs.org patch vendor-advisory
- MDVSA-2014:253 vendor-advisory
- [oss-security] 20140619 CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] mailing-list
- [oss-security] 20141104 Re: CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] mailing-list
- 68111 vdb-entry
- USN-2431-1 vendor-advisory
- bugzilla.redhat.com
- GLSA-201612-49 vendor-advisory