PT-2019-6326 · Supervisor+3 · Supervisor+3

Luan Souza + 1 · Published 2019-05-29 · Updated 2024-08-04 · CVE-2019-12105

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Supervisor versions 4.0.2 and earlier

Description The issue is related to the inet http server component, which can allow an unauthenticated user to read log files or restart a service if it is enabled and no password is set. The maintainer has added an additional warning to the documentation but will not remove the ability to run an open server. This could potentially allow a remote attacker to access confidential data or cause a denial of service.

Recommendations For Supervisor versions 4.0.2 and earlier, consider disabling the inet http server component or setting a password to prevent unauthorized access. As a temporary workaround, restrict access to the Supervisor logs and services to minimize the risk of exploitation. Ensure that the inet http server component is properly configured and secured to prevent potential attacks.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

ALT-PU-2019-4165

BDU:2023-01676

CVE-2019-12105

OPENSUSE-SU-2024:11414-1

PYSEC-2019-126

Affected Products

Alt Linux

Astra Linux

Debian

Supervisor

References · 19

• https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11414-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12105 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-12105 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-12105 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01676 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12105 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12105 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12105 · Security Note
• https://ubuntu.com/security/CVE-2019-12105 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-126 · Vendor Advisory
• https://github.com/Supervisor/supervisor/issues/1245 · Note