~ / search / GHSA-cj78-rgw3-4h5p

GHSA-cj78-rgw3-4h5p

Improper Restriction of XML External Entity Reference in trytond and proteus

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-26661

Packages

EcosystemPackageAffectedFixed in
PyPI trytond >= 5.0.0, < 5.0.46 5.0.46
PyPI trytond >= 6.0.0, < 6.0.16 6.0.16
PyPI trytond >= 6.1.0, < 6.2.6 6.2.6
PyPI proteus >= 5.0.0, < 5.0.12 5.0.12
PyPI proteus >= 6.0.0, < 6.0.5 6.0.5
PyPI proteus >= 6.1.0, < 6.2.2 6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.

References

External links from the advisory. They lead to third-party sites.