Critical Vulnerability in Supervisor Package: Unauthenticated Access to Logs and Service Control
Summary
ALPINE-CVE-2019-12105: In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Affects supervisor versions < 4.1.0-r0. Fixed in 4.1.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Supervisor package is a process control system that allows users to monitor and control a number of processes on UNIX-like operating systems. It provides a web-based interface for managing services, making it easier for developers to ensure that their applications are running smoothly. However, a significant vulnerability exists in versions prior to 4.1.0-r0, where an unauthenticated user can access log files and restart services if the inet_http_server component is enabled without a password.
Vulnerability Detail
In Supervisor versions up to 4.0.2, an unauthenticated user can exploit the inet_http_server component to read sensitive log files or restart services. This vulnerability arises from the lack of authentication when the server is enabled without a password, potentially leading to unauthorized access and control over critical services. The maintainer has acknowledged this issue and added warnings in the documentation, but the ability to run an open server remains unchanged.
How To Fix
Minimum fixed version
4.1.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade supervisorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the inet_http_server component in your Supervisor configuration or setting a strong password to restrict access. You can do this by modifying the Supervisor configuration file (usually located at /etc/supervisord.conf) and ensuring that the following lines are included:
[inet_http_server] port=*:9001 username:password
Conclusion
The vulnerability in the Supervisor package presents a significant risk due to the potential for unauthorized access to logs and service control. It is crucial for users to update to the patched version 4.1.0-r0 or later and to configure the inet_http_server securely to protect their applications.
See every vulnerability recorded for supervisor →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
All versions of Supervisor prior to 4.1.0-r0 are affected by this vulnerability.
No, the inet_http_server is not enabled by default, but if a user enables it without setting a password, it becomes vulnerable.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If an immediate update is not possible, disable the inet_http_server or set a strong password to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for supervisor.
