CVE-2014-8583
Public on 2014-12-16
Modified on 2018-04-26
Description
mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | mod24_wsgi | 2018-04-26 | ALAS-2018-987 | Fixed |
| Amazon Linux 2 - Core | mod_wsgi | 2018-04-05 | ALAS2-2018-987 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
| NVD | CVSSv2 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |