[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

DSA-3942-1 supervisor -- supervisor

ID: oval:org.secpod.oval:def:603039Date: (C)2017-09-05   (M)2023-11-13
Class: PATCHFamily: unix




Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server as the same user as supervisord. The vulnerability has been fixed by disabling nested namespace lookup entirely. supervisord will now only call methods on the object registered to handle XML-RPC requests and not any child objects it may contain, possibly breaking existing setups. No publicly available plugins are currently known that use nested namespaces. Plugins that use a single namespace will continue to work as before. Details can be found on the upstream issue at https://github.com/Supervisor/supervisor/issues/964 .

Platform:
Debian 8.x
Debian 9.x
Product:
supervisor
Reference:
DSA-3942-1
CVE-2017-11610
CVE    1
CVE-2017-11610
CPE    5
cpe:/o:debian:debian_linux:9.0
cpe:/o:debian:debian_linux:8.x
cpe:/o:debian:debian_linux:8.0
cpe:/a:supervisord:supervisor
...

© SecPod Technologies