CVE-2019-12105

Name	CVE-2019-12105
Description	In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
supervisor (PTS)	jessie, jessie (lts)	3.0r1-1+deb8u1	vulnerable
	stretch (security), stretch (lts), stretch	3.3.1-1+deb9u1	vulnerable
	buster	3.3.5-1	vulnerable
	bullseye	4.2.2-2	vulnerable
	bookworm	4.2.5-1	vulnerable
	sid, trixie	4.2.5-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
supervisor	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/Supervisor/supervisor/issues/1245
Disupted upstream to be vulnerability. inet_http_server is not enabled by
default (neither upstream nor in Debian packaging). Details in the upstream
issue.