[DRE-maint] Bug#1077160: passenger: warns for security vulnerability

[Patrice Duroux]

Package: passenger
Version: 6.0.17+ds-1
Severity: normal

Hi,

This is like a follow-up to #1029715.

Here is what log message says:

A security update is available for your version (6.0.17) of Phusion
Passenger(R). We strongly recommend upgrading to version 6.0.22.
Additional security update check information:
- [Fixed in 6.0.19] [CVE-2023-38545] A vulnerability existed in
libcurl before 8.4.0 which was the library used for Passenger proxy
functionality. Exploiting this vulnerability would require two
preconditions. First a SOCKS5 proxy to be configured for Passenger
licensing, anonymous telemetry, or security update check which is not
the default but is possible. Second the attacker would need to cause
Passenger to use an attacker-controlled URL when performing these
requests. Causing Passenger to use non-standard urls requires that the
attacker already have code execution on the Passenger host, or control
of the Passenger config. If exploited this vulnerability could lead to
code execution, due to buffer overflow.

Many thanks,
Patrice