CVE-2017-11610: Debian Linux

High severity, CVSS 8.8. EPSS: 87.4% chance of exploitation in the next 30 days.

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 24 only; version 25 only; version 26 only
• Red Hat Cloudforms: version 4.5 only
• Supervisord Supervisor: up to and including 3.0; version 3.1.0 only; version 3.1.1 only; version 3.1.2 only; version 3.1.3 only; version 3.2.0 only; …

Published 2017-08-23. Last modified 2026-06-17.