CVE-2017-11610: Critical severity supervisord vulnerability
A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.
Upstream issue:
https://github.com/Supervisor/supervisor/issues/964
Upstream patches:
3.3.3 https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e 3.2.4 https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e 3.1.4 https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88 3.0.1 https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0
Other sources
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11610?
CVE-2017-11610 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-11610?
To fix CVE-2017-11610, upgrade to supervisor version 3.3.3 or higher.
What versions are affected by CVE-2017-11610?
CVE-2017-11610 affects supervisor versions prior to 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3.
Can CVE-2017-11610 be exploited remotely?
Yes, CVE-2017-11610 can be exploited by remote authenticated users to execute arbitrary commands.
What systems are vulnerable to CVE-2017-11610?
CVE-2017-11610 impacts systems using affected versions of the supervisor package, including those from Red Hat and Debian.