CVE-2019-12105

NameCVE-2019-12105
Description** DISPUTED ** In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
supervisor (PTS)jessie (security), jessie3.0r1-1+deb8u1vulnerable
stretch (security), stretch3.3.1-1+deb9u1vulnerable
buster3.3.5-1vulnerable
bullseye, sid4.1.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
supervisorsource(unstable)(unfixed)unimportant

Notes

https://github.com/Supervisor/supervisor/issues/1245
Disupted upstream to be vulnerability. inet_http_server is not enabled by
default (neither upstream nor in Debian packaging). Details in the upstream
issue.

Search for package or bug name: Reporting problems