| Vulnerability Name: | CVE-2014-8583 (CCN-98464) | ||||||||||||||||||||
| Assigned: | 2014-11-04 | ||||||||||||||||||||
| Published: | 2014-11-04 | ||||||||||||||||||||
| Updated: | 2017-07-01 | ||||||||||||||||||||
| Summary: | mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors. | ||||||||||||||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||||||||||||||
| CVSS v2 Severity: | 6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C) 5.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-254 | ||||||||||||||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||||||||||||||
| References: | Source: CONFIRM Type: UNKNOWN http://advisories.mageia.org/MGASA-2014-0513.html Source: MITRE Type: CNA CVE-2014-8583 Source: SUSE Type: UNKNOWN openSUSE-SU-2014:1590 Source: CCN Type: mod_wsgi Web page Version 4.2.4 Source: CONFIRM Type: Patch, Vendor Advisory http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html Source: CCN Type: oss-security Mailing List, Thu, 19 Jun 2014 16:23:55 +1000 CVE request: mod_wsgi group privilege dropping [was Re: [oss-security] Security release for mod_wsgi (version 3.5)] Source: CCN Type: Offensive Security Exploit Database [11-04-2014] Re: CVE request: mod_wsgi group privilege dropping [was Re: [oss-security] Security release for mod_wsgi (version 3.5)] Source: MANDRIVA Type: UNKNOWN MDVSA-2014:253 Source: MLIST Type: UNKNOWN [oss-security] 20140619 CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] Source: MLIST Type: UNKNOWN [oss-security] 20141104 Re: CVE request: mod_wsgi group privilege dropping [was Re: Security release for mod_wsgi (version 3.5)] Source: BID Type: UNKNOWN 68111 Source: CCN Type: BID-68111 Apache 'mod_wsgi' Module Privilege Escalation Vulnerability Source: UBUNTU Type: UNKNOWN USN-2431-1 Source: CCN Type: Red Hat Bugzilla Bug 1111034 (CVE-2014-8583) CVE-2014-8583 mod_wsgi: failure to handle errors when attempting to drop group privileges Source: CONFIRM Type: UNKNOWN https://bugzilla.redhat.com/show_bug.cgi?id=1111034 Source: XF Type: UNKNOWN modwsgi-priv-esc(98464) Source: GENTOO Type: UNKNOWN GLSA-201612-49 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||