Unauthenticated User Can Read Log Files or Restart Service in Supervisor
Summary
CVE-2019-12105: In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Affects supervisor across 2 version ranges.
< 4.1.0-r0
< 4e334d9cf2a1daff685893e35e72398437df3dcb
Fixed in 4.1.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Supervisor is a process control system that allows users to monitor and control a number of processes on UNIX-like operating systems. It provides a client-server architecture, where the server component runs as a background process and the client component allows users to interact with the server. Supervisor is commonly used to manage and control various services and applications. However, versions up to 4.0.2 of Supervisor are vulnerable to an issue that allows an unauthenticated user to read log files or restart a service.
Vulnerability Detail
The vulnerability, identified as CVE-2019-12105, arises from the inet_http_server component in Supervisor. Although this component is not enabled by default, if a user enables it without setting a password, Supervisor logs a warning message. This warning message indicates that an unauthenticated user can read log files or restart a service. While the ability to run an open server will not be removed, the documentation now includes an additional warning about the potential risks.
How To Fix
Minimum fixed version
4.1.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade supervisorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the risk by ensuring that the inet_http_server component is not enabled or by setting a strong password for it. By enabling authentication and setting a password, users can prevent unauthorized access to log files and service restarts.
Conclusion
In conclusion, Supervisor versions up to 4.0.2 are vulnerable to an issue that allows an unauthenticated user to read log files or restart a service. Users should upgrade to version 4.1.0-r0 or later to fix this vulnerability. Alternatively, they can mitigate the risk by disabling the inet_http_server component or setting a strong password for it. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for supervisor →
FAQ
Supervisor is a process control system that allows users to monitor and control multiple processes on UNIX-like operating systems. It provides a client-server architecture and is commonly used to manage various services and applications.
The vulnerability allows an unauthenticated user to read log files or restart a service in Supervisor. This can potentially lead to unauthorized access to sensitive information or disruption of critical services.
No, the inet_http_server component in Supervisor is not enabled by default. Users need to explicitly enable it if they require its functionality.
If the inet_http_server component is enabled without setting a password, Supervisor logs a warning message indicating that an unauthenticated user can read log files or restart a service.
To fix this vulnerability, users should upgrade to Supervisor version 4.1.0-r0 or later. Alternatively, users can mitigate the risk by ensuring that the inet_http_server component is not enabled or by setting a strong password for it.
Related vulnerabilities
Recent vulnerabilities recorded for supervisor.
