Candidate: CVE-2017-11610
PublicDate: 2017-08-23 14:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11610
 https://github.com/Supervisor/supervisor/issues/964
Description:
 The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x
 before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to
 execute arbitrary commands via a crafted XML-RPC request, related to nested
 supervisord namespace lookups.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870187
Priority: medium
Discovered-by: Calum Hutton
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [8.8 HIGH]

Patches_supervisor:
 other: https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e
 other: https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e
 other: https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88
 other: https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0
upstream_supervisor: released (3.3.1-1.1)
precise/esm_supervisor: DNE
trusty_supervisor: released (3.0b2-1ubuntu0.1)
trusty/esm_supervisor: released (3.0b2-1ubuntu0.1)
vivid/ubuntu-core_supervisor: DNE
xenial_supervisor: released (3.2.0-2ubuntu0.2)
zesty_supervisor: released (3.3.1-1+deb9u1build0.17.04.1)
artful_supervisor: not-affected (3.3.1-1.1)
bionic_supervisor: not-affected (3.3.1-1.1)
devel_supervisor: not-affected (3.3.1-1.1)