CVE-2019-12105: High severity supervisord vulnerability
DISPUTED In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inethttpserver, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12105?
CVE-2019-12105 is considered a medium severity vulnerability due to the potential for unauthorized access to log files.
How do I fix CVE-2019-12105?
To mitigate CVE-2019-12105, ensure that the inet_http_server component is not enabled or require a strong password if it is enabled.
Who is affected by CVE-2019-12105?
CVE-2019-12105 affects users of Supervisor version 4.0.2 or earlier who have the inet_http_server enabled without a password.
What can an attacker do in CVE-2019-12105?
An attacker can read log files or restart a service if they gain unauthorized access to the inet_http_server.
Is CVE-2019-12105 still a concern for later versions of Supervisor?
No, CVE-2019-12105 is only applicable to Supervisor versions up to and including 4.0.2.