CVE-2013-2119: Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of...

Security readout for executives and security teams

This is a local security flaw in older Phusion Passenger Ruby gem versions. A user already on the server could interfere with a predictable temporary file path, potentially stopping an application from starting or gaining elevated privileges. It is not described as remotely exploitable in the provided sources. Exposure is most likely on older Ruby application servers running Phusion Passenger gem versions before 3.0.21 or 4.0.x before 4.0.5. Systems without local untrusted users have lower practical exposure, but shared hosting, multi-user servers, and legacy stacks need attention. Prioritize remediation for shared or multi-user Ruby application servers and any legacy Passenger deployments. The issue is not presented as internet-facing, but privilege gain on an application host can materially affect confidentiality, integrity, and availability. Mitigation focus: Upgrade Phusion Passenger to 3.0.21, 4.0.5, or a later vendor-supported release.; For Red Hat-managed systems, review and apply RHSA-2013:1136 packages where applicable.; Inventory Ruby applications and servers using legacy Passenger gem deployments..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.