Re: phusion passenger CVE-2017-1000384

[John Lightsey <jd () cpanel net>]

On 11/17/17 3:19 PM, Jakub Wilk wrote:
> * John Lightsey <jd () cpanel net>, 2017-11-17, 14:58:
> > https://github.com/phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf
>
> This adds:
>
>   #ifdef false
>   ...
>   #endif
>
> But false _is_ a defined macro in this file, so this doesn't disable the
> code inside. I guess they meant to write:
>
>   #if false
>   ...
>   #endif

True enough. The removal of the call to inferApplicationInfo() is the
key part of the change.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature