CVE-2014-8583

Description

mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.

How to fix CVE-2014-8583

To remediate CVE-2014-8583, upgrade the affected package to a fixed version below.

• Debian/mod-wsgi—upgrade to 4.2.7-1 or later

Is CVE-2014-8583 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 4.2.7-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-8583