CVE-2019-12105

Advisory

Affected versions of Supervisor allow an unauthenticated user to read log files or restart a service when the inet_http_server component is enabled without a password. While this component is not activated by default, failure to secure it with a password, despite logged warnings and documentation advisories, exposes the system to unauthorized access.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://pypi.org/project/supervisor
• https://data.safetycli.com/changelogs/supervisor/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12105
• https://github.com/Supervisor/supervisor/issues/1245