CVE-2019-12105

高 8.2CVE-2019-12105 · PYSEC-2019-126 · 10/09/2019 公開 · 17/06/2026 更新

要点

CVE-2019-12105 は supervisor, supervisor (supervisord) に影響する深刻度「高」 (CVSS 8.2) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.3%（全脆弱性の 83.4% より高い）。
対処：4.0.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
supervisor PyPI	`< 4.0.3`	`4.0.3`
supervisor supervisord	`≤ 4.0.2`	修正版なし

概要

** DISPUTED ** In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation.

NVD の説明

In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation