CVE-2017-11610

Description

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

How to fix CVE-2017-11610

To remediate CVE-2017-11610, upgrade the affected package to a fixed version below.

• Alpine/supervisor—upgrade to 3.2.4-r0 or later
• —upgrade to 3.3.1-1.1 or later
• —upgrade to 3.0a8-1.1+deb7u2 or later
• —upgrade to 3.0r1-1+deb8u1 or later
• —upgrade to 3.0.1 or later
• —upgrade to 3.0.1 or later

Is CVE-2017-11610 being exploited?

Likely — EPSS is 94.2%, placing CVE-2017-11610 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (6)

• from 0, < 3.2.4-r0
• from 0, < 3.3.1-1.1
• from 0, < 3.0a8-1.1+deb7u2
• from 0, < 3.0r1-1+deb8u1
• from 0, < 3.0.1
• from 0, < 3.0.1, >= 3.1, < 3.1.4, >= 3.2, < 3.2.4, >= 3.3, < 3.3.3

CVSS scores

References (22)

• ADVISORYgithub.com/advisories/GHSA-x7c8-4x3h-874w
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-11610
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2017-11610
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-11610
• WEB