Phusion Blog

Phusion Passenger is a fast and robust web server and application server for Ruby, Python, Node.js and Meteor. Passenger takes a lot of complexity out of deploying web apps, and adds powerful enterprise-grade features that are useful in production. High-profile companies such as Apple, New York Times, AirBnB, Juniper, American Express, etc are already using it, as well as over 350.000 websites.

Phusion Passenger 4.0.41 has been released ahead of time in order to address the OpenSSL heartbleed security issue (CVE-2014-0160). This is an extremely serious vulnerability in OpenSSL which can completely negate the security that it provides. Users are advised to upgrade as soon as possible.

Phusion Passenger’s relationship with the OpenSSL heartbleed vulnerability is as follows.

We provide precompiled binaries for Passenger Standalone. These binaries are statically linked to OpenSSL in order to make them useable on a wide range of operating systems. With 4.0.41, the binaries have been upgraded to link against OpenSSL 1.0.1g, which fixes the heartbleed vulnerability.

You are vulnerable if:

• You are using Passenger Standalone, with SSL enabled inside Passenger Standalone (that is, passenger start --ssl).

You are not vulnerable (to the Passenger Standalone static linking issue) if:

• You are not using Passenger Standalone (e.g. if you’re using Phusion Passenger through the Apache or Nginx integration mode).
• You are using Passenger Standalone, but without SSL.
• Your Passenger Standalone is behind another SSL-enabled reverse proxy.

Update: Please note that the only thing this Phusion Passenger update fixes, is any potential vulnerabilities in the Passenger Standalone binaries that we provide. Your system as a whole may still be vulnerable because you’re running a vulnerable OpenSSL version. Please check with your vendor for system updates.

There aren’t many other changes in this release:

• Fixed some issues with printing UTF-8 log files on Heroku.
• Added a new flag --ignore-app-not-running to passenger-config restart-app.
  When this flag is given, passenger-config restart-app will exit successfully
  when the specified application is not running, instead of exiting with
  an error.

Installing or upgrading to 4.0.41

OS X	Debian	Ubuntu
Heroku	Ruby gem	Tarball

Final

Phusion Passenger’s core is open source. Please fork or watch us on Github. 🙂

Phusion Passenger is a fast and robust web server and application server for Ruby, Python, Node.js and Meteor. Passenger takes a lot of complexity out of deploying web apps, and adds powerful enterprise-grade features that are useful in production. High-profile companies such as Apple, New York Times, AirBnB, Juniper, American Express, etc are already using it, as well as over 350.000 websites.

Phusion Passenger is under constant maintenance and development. Version 4.0.38 is a bugfix release.

Phusion Passenger also has an Enterprise version which comes with a wide array of additional features. By buying Phusion Passenger Enterprise you will directly sponsor the development of the open source version.

Recent changes

• Fixed a symlink-related security vulnerability.

  Urgency: low
  Scope: local exploit
  Summary: writing files to arbitrary directory by hijacking temp directories
  Affected versions: 4.0.37
  Fixed versions: 4.0.38
  CVE-2014-1832

  Description: This issue is related to CVE-2014-1831 (the security issue as mentioned in the 4.0.37 release notes). The previous fix was incomplete, and still has a (albeit smaller) small attack time window in between two filesystem checks. This attack window is now gone.

• Added support for the new Ruby 2.1.0 out-of-band garbage collector. This can much improve garbage collection performance, and drastically reduce request times.
• Passenger Standalone is now compatible with IPv6.
• Fixed some compilation problems on Solaris. See issue #1047.
• passenger-install-apache2-module and passenger-install-nginx-module now automatically run in `–auto` mode if stdin is not a TTY. Fixes issue #1030.
• Fixed an issue with non-bundled Meteor apps not correctly running in production mode.
• The `PassengerPreStart` option is now compatible with IPv6 server sockets.
• When running Python WSGI apps, `wsgi.run_once` is now set to False. This should improve the performance of certain apps and frameworks.
• When handling HTTP requests with chunked transfer encoding, the ‘Transfer-Encoding’ header is no longer passed to the application. This is because the web server already buffers and dechunks the request body.
• Fixed a possible hang in Phusion Passenger for Nginx when Nginx is instructed to reload or reopen log files. Thanks to Feng Gu, pull request #97.
• The preferred Nginx version has been upgraded to 1.4.6.
• Fixed a problem with running passenger-install-apache2-module and passenger-install-nginx-module on JRuby. They were not able to accept any terminal input after displaying the programming language menu.

Installing or upgrading to 4.0.38

OS X	Debian	Ubuntu
Heroku	Ruby gem	Tarball

Final

Phusion Passenger’s core is open source. Please fork or watch us on Github. 🙂

If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.

Phusion Passenger is a fast and robust web server and application server for Ruby, Python, Node.js and Meteor. Passenger takes a lot of complexity out of deploying web apps, and adds powerful enterprise-grade features that are useful in production. High-profile companies such as Apple, New York Times, AirBnB, Juniper, American Express, etc are already using it, as well as over 350.000 websites.

Phusion Passenger is under constant maintenance and development. Version 4.0.25 is a bugfix release.

Phusion Passenger also has an Enterprise version which comes with a wide array of additional features. By buying Phusion Passenger Enterprise you will directly sponsor the development of the open source version.

Recent changes

• [Nginx] Upgraded preferred Nginx version to 1.4.4 because of CVE-2013-4547. Nginx users are advised to upgrade immediately.
• [Nginx] Introduced the `passenger_restart_dir` option.
• The `PassengerEnv`/`passenger_env`/`–environment` option now also sets NODE_ENV, so that Node.js frameworks like Connect can properly respond to the environment.
• Fixed a bug in our Debian/Ubuntu packages causing `passenger-install-nginx-module` not to be able to compile Nginx.
• Arbitrary Node.js application structures are now supported.

Installing or upgrading to 4.0.25

OS X	Debian	Ubuntu
Heroku	Ruby gem	Tarball

Final

Phusion Passenger’s core is open source. Please fork or watch us on Github. 🙂

If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.

Phusion Passenger is software that deploys Ruby and Python web apps, by integrating into Apache and Nginx and turning them into a fully-featured application server. It is very fast, stable and robust and thus used by the likes of New York Times, AirBnB, Symantec, Pixar, etc. It comes with many features that make your life easier and your application perform better.

Phusion Passenger is under constant maintenance and development. Version 4.0.5 is a bugfix release.

Phusion Passenger also has an Enterprise version which comes with a wide array of additional features. By buying Phusion Passenger Enterprise you will directly sponsor the development of the open source version.

Recent changes

• [Standalone] Fixed a regression that prevented Passenger Standalone
  from starting. Fixes issue #899.
• Fixed security vulnerability CVE-2013-2119.

  Urgency: low
  Scope: local exploit
  Summary: denial of service and arbitrary code execution by hijacking temp files
  Affected versions: all versions
  Fixed versions: 3.0.21 and 4.0.5

  Description:
  Phusion Passenger’s code did not always create temporary files and directories in a secure manner. Temporary files and directories were sometimes created with a predictable filename. A local attacker can pre-create temporary files, resulting in a denial of service. In addition, this vulnerability allows a local attacker to run arbitrary code as another user, by hijacking temporary files.

  By pre-creating certain temporary files with certain permissions, attackers can prevent Passenger Standalone from starting (denial of service).

  By pre-creating certain temporary files with certain other permissions, attackers can trick passenger start and the build system (which is invoked by passenger-install-apache2-module/passenger-install-nginx-module) to run arbitrary code. The user that the code is run as, is equal to the user that ran passenger start or the build system. Attacks of this nature have to be timed exactly right. The attacker must overwrite the file contents right after Phusion Passenger has created the file contents, but right before the file is used. In the context of passenger start, the vulnerable window begins right after Passenger Standalone has created the Nginx config file, and ends when Nginx has read the config file. Once Nginx has started and initialized, the system is no longer vulnerable. passenger stop and other Passenger Standalone commands besides start are not vulnerable. In the context of the build system, the vulnerable window begins when passenger-install-apache2-module/passenger-install-nginx-module prints its first dependency checking message, and ends when it prints the first compiler command.

  Only the passenger start command, the passenger-install-apache2-module command and the passenger-install-nginx-module commands are vulnerable. Phusion Passenger for Apache and Phusion Passenger for Nginx (once they are installed) are not vulnerable.

  Fixed versions:
  3.0.21 and 4.0.5 have been released to address this issue.

  Workaround:
  You can use this workaround if you are unable to upgrade. Before invoking any Phusion Passenger command, set the TMPDIR environment variable to a directory that is not world-writable. Special care must be taken when you use sudo: sudo resets all environment variables, so you should either invoke sudo with -E, or you must set the environment variable after gaining root privileges with sudo.

  Credits:
  Thanks to Kurt Seifried and Michael Scherer from Red Hat for reporting this issue.

Installing 4.0.5

Quick install/upgrade

Phusion Passenger Enterprise users can download the Enterprise version of 4.0.5 from the Customer Area.

Open source users can install the open source version of 4.0.5 with the following commands:

gem install passenger
passenger-install-apache2-module
passenger-install-nginx-module

You can also download the tarball at Google Code. We strongly encourage you to cryptographically verify files after downloading them.

In-depth instructions

In-depth installation and upgrade instructions can be found in the Installation section of the documentation. The documentation covers:

• Detailed tarball installation instructions.
• Detailed upgrade instructions.
• Installation troubleshooting.
• Installation through APT and YUM.

You can view the documentation online here:

• Apache manual
• Nginx manual

Final

If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.

Phusion Passenger 3.0.21 is a bug fix release which backports some fixes from the 4.0 series. It is the last release in the 3.0 series and is meant for people who are not yet able to upgrade to the 4.0 series at this time.

Changes in this version

• Rebootstrapped the libev configure to fix compilation problems on Solaris 11.
• Fixed support for RVM mixed mode installations. Fixes issue #828.
• Fixed encoding problems in Phusion Passenger Standalone.
• Changed preferred Nginx version to 1.2.9.
• Catch exceptions raised by Rack application objects.
• Fix for CVE-2013-2119. Details can be found in the announcement for version 4.0.5.
• Version 3.0.20 was pulled because its fixes were incomplete.

Installing 3.0.21

Quick install/upgrade

Phusion Passenger Enterprise users can download the Enterprise version of 3.0.21 from the Customer Area.

Open source users can install the open source version of 3.0.21 with the following commands:

gem install passenger --version 3.0.21
passenger-install-apache2-module
passenger-install-nginx-module

You can also download the tarball at RubyForge. We strongly encourage you to cryptographically verify files after downloading them.

In-depth instructions

In-depth installation and upgrade instructions can be found in the Installation section of the documentation. The documentation covers:

• Detailed tarball installation instructions.
• Detailed upgrade instructions.
• Installation troubleshooting.
• Installation through APT and YUM.

You can view the documentation online here:

• Apache manual
• Nginx manual

Final

If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.

Phusion Passenger is software that deploys Ruby and Python web apps, by integrating into Apache and Nginx and turning them into a fully-featured application server. It is very fast, stable and robust and thus used by the likes of New York Times, AirBnB, Symantec, Pixar, etc. It comes with many features that makes your life easier and your application perform better.

We are releasing an emergency release in response to a recently discovered remote code execution vulnerability in Nginx (CVE-2013-2028). Many versions of Nginx 1.3, as well as Nginx 1.4.0, are affected. Phusion Passenger 4.0.2 installs Nginx 1.4.1 by default. There are no other code changes.

Installing 4.0.2

Quick install/upgrade

Phusion Passenger Enterprise users can download the Enterprise version of 4.0.2 from the Customer Area.

Open source users can install the open source version of 4.0.2 with the following commands:

gem install passenger
passenger-install-apache2-module
passenger-install-nginx-module

You can also download the tarball at Google Code. We strongly encourage you to cryptographically verify files after downloading them.

In-depth instructions

In-depth installation and upgrade instructions can be found in the Installation section of the documentation. The documentation has been updated to cover 4.0 changes, including Enterprise features. You can view them online here:

• Apache manual
• Nginx manual

Final

If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.