CVE-2019-12105

Advisory

** Disputed ** Affected versions of Supervisor allow an unauthenticated user to read log files or restart a service when the inet_http_server component is enabled without a password. While this component is not activated by default, failure to secure it with a password exposes the system to unauthorized access. Logged warnings and documentation advisories were added to prevent this risky usage.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://pypi.org/project/supervisor
• https://data.safetycli.com/changelogs/supervisor/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12105
• https://github.com/Supervisor/supervisor/issues/1245
• https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb