CVE-2019-12105

NameCVE-2019-12105
DescriptionIn Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
supervisor (PTS)jessie, jessie (lts)3.0r1-1+deb8u1vulnerable
stretch (security), stretch (lts), stretch3.3.1-1+deb9u1vulnerable
buster3.3.5-1vulnerable
bullseye4.2.2-2vulnerable
sid, trixie, bookworm4.2.5-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
supervisorsource(unstable)(unfixed)unimportant

Notes

https://github.com/Supervisor/supervisor/issues/1245
Disupted upstream to be vulnerability. inet_http_server is not enabled by
default (neither upstream nor in Debian packaging). Details in the upstream
issue.

Search for package or bug name: Reporting problems