From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-3942-1
[email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2017
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : supervisor
CVE ID : CVE-2017-11610
Debian Bug : 870187
Calum Hutton reported that the XML-RPC server in supervisor, a system
for controlling process state, does not perform validation on requested
XML-RPC methods, allowing an authenticated client to send a malicious
XML-RPC request to supervisord that will run arbitrary shell commands on
the server as the same user as supervisord.
The vulnerability has been fixed by disabling nested namespace lookup
entirely. supervisord will now only call methods on the object
registered to handle XML-RPC requests and not any child objects it may
contain, possibly breaking existing setups. No publicly available
plugins are currently known that use nested namespaces. Plugins that use
a single namespace will continue to work as before. Details can be found
on the upstream issue at
https://github.com/Supervisor/supervisor/issues/964 .
For the oldstable distribution (jessie), this problem has been fixed
in version 3.0r1-1+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 3.3.1-1+deb9u1.
We recommend that you upgrade your supervisor packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
[email protected]
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmQrB9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SsTRAAlYytqmEDurPZLfuLt/+LqRVd6JTK1MLxQeADltPvjDLPn6ZwUxwUiw5/ smnv+nGOej2Jnyk+4LdYnZ5zN8gzD4o59HjGEGoONJYAKvzsR8mijFtvcvurwnAe OkTrV6T8ANPNMsiLsbRhIHED3CxO4rWE77rlyIzIF93FFVzNoF3O4Wg9gXZMzmjo uGLnTxj1bzfFuwN963axPoM56HTeCyGBF85/bLlZyD/y1oMI9lLQKSOZ+gd2QmQY UDgxaAAaxEX+Kqr07kk/7qmSIZON35dTibSkqdWN/GY81uMIFX4t7P9RD9DmIpw4 3B/REp3UwOzdzPM0f1mOZxZ2xqTRH4sHojuX+WEuC8nz0O+ZULv4vD8Af/eXFhQE Q028LgnU3x+jT/LBiFZERcznEiWnsXbvR++Ty2OGODkqlJhft0Jes3Y2GhbOXqOD vLYBjKuu9ov67zzOUYJnlOEy1EnqioI6e4QQIQ171a3Wk4m4J+//Gk3j/3LsC264 wKNs1rA32vMAledUoWiU3739GIIw65T7ur/7CV1W8hDrNFxfWD6m5vAZ586tTgam KURn2iEFhm7MLER35a4l+Ipdoz3aXiO6tC3oCvh2x+xY9DGBUGawzDJ6BqC6CVqU P5Rn/fqf4tXkJDXda2k24OGbPmtgdS8WzrQDA4w1pplN6RN2/Pk=
=Jo+K
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)