{"action":"Upgrade supervisor to 4.0.3 or later.","affected":[{"fixed":"4.0.3","introduced":"0"}],"component":"supervisor","cve_ids":["CVE-2019-12105"],"ecosystem":"PyPI","epss":0.02312,"exploited":false,"fixed_versions":["4.0.3"],"id":"tcs_01M5KG8F2H65FJNF3DY37MEH9C","modified_at":"2023-11-08T04:01:02.830789Z","published_at":"2019-09-10T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-126","https://github.com/Supervisor/supervisor/commit/4e334d9cf2a1daff685893e35e72398437df3dcb","https://github.com/Supervisor/supervisor/issues/1245","http://supervisord.org/configuration.html#inet-http-server-section-settings"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-126","url":"https://osv.dev/vulnerability/PYSEC-2019-126"}],"summary":"** DISPUTED ** In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enable"}