Sysop Solutions Security Advisory
cPanel has disclosed a security vulnerability affecting Phusion Passenger's Watchdog API, which can potentially allow local privilege escalation on affected servers.
Component: Phusion Passenger Watchdog API
Impact: Local Privilege Escalation
Affected Platform: cPanel & WHM servers with affected Passenger packages installed
According to cPanel, all cPanel & WHM versions can be affected if one or more of the vulnerable Passenger packages are installed.
The following packages may be affected:
ea-apache24-mod-passengerea-passenger-srcea-ruby27-rubygem-passengerea-ruby27-mod_passengerea-ruby24-rubygem-passengerea-ruby24-mod_passengerea-nginx-passenger| Passenger Package | Patched Version |
|---|---|
| ea-apache24-mod-passenger | 6.1.8-2 |
| ea-passenger-src | 6.1.8-2 |
| ea-ruby27-rubygem-passenger | 6.0.27-2 (EL7) 6.1.8-2 (EL8) |
| ea-ruby27-mod_passenger | 6.0.27-2 (EL7) 6.1.8-2 (EL8) |
| ea-ruby24-rubygem-passenger | 6.0.20-4 |
| ea-ruby24-mod_passenger | 6.0.20-4 |
| ea-nginx-passenger | 6.1.8-2 |
If Passenger is installed on your server, we strongly recommend updating the affected packages to their latest available versions.
cPanel provides the following command to update all installed packages:
This command updates the installed packages and applies the latest available fixes.
If your server is managed by Sysop Solutions, our team can review the installed Passenger packages and ensure that applicable security updates are applied.
Customers managing their own servers should verify whether Passenger is installed and update the affected packages as soon as possible.
If you are unsure whether your server is affected or need assistance updating Passenger, please contact Sysop Solutions Support.
For complete technical details, affected packages, patched versions, verification commands, and additional security guidance, please refer to the official cPanel advisory:
View Official cPanel Security Advisory
Sysop Solutions recommends keeping all server software and security packages up to date to help protect your infrastructure.
Regards,
Sysop Solutions
Hosting & Server Management