Passenger 5.0.18: crash fixes, Ubuntu 15.10 "Wily" packages

by Hongli Lai

Version 5.0.18 of the Phusion Passenger application server for Ruby, Python, Node.js and Meteor has been released.

If you hadn't already, be sure to check out the many major improvements that the 5.x series of Passenger introduces. And please be aware that you can enjoy enterprise features and sponsor the open source development directly by buying Phusion Passenger Enterprise.

Version 5.0.17 has been skipped because an issue was discovered shortly after its release. The changes in 5.0.17 and 5.0.18 together are described in this blog post.

Crash fixes

Several crash bugs due to memory corruption have been discovered thanks to the help of Dmitry Polushkin and other people. There were two issues which caused memory to be corrupted: one was failing to properly reinitialize a pointer in the palloc memory allocation system (GH-1587), the other was an off-by-one bug which caused a stack overflow. However, both of these issues only occur when the client and/or the application send a large number of headers, so they were not discovered earlier.

Ubuntu 15.10 "Wily" packages

We now have packages for Ubuntu 15.10 "Wily" even though Ubuntu 15.10 isn't out yet.

Other bug fixes

  • Fixes the Node.js PhusionPassenger.on('exit') event. This event worked if you restart the app or detach an application process, but not if you stop Passenger.
  • Fixes support for passenger_pre_start URLs that contain very long authentication strings. This was caused by the fact that our Base64 encoder generated unexpected newlines.
  • [Standalone] Improves application prestarting. Application prestarting is now available in combination with the 'builtin' engine, and now works when SSL is used.

Installing 5.0.18

Please see the installation guide.

Upgrading to 5.0.18

We recommend upgrading to the latest version of Passenger, especially if you are on version 5.0.13 or below.


OS X
Debian
Ubuntu
Heroku

Red Hat
CentOS
Ruby gem
Tarball

Docker

If you are upgrading from 4.x, please read the 5.0 upgrade notes to learn about potential upgrade caveats.