~ / search / GHSA-pm3h-mm62-pwm8

GHSA-pm3h-mm62-pwm8

XML Entity Expansion in trytond and proteus

Source: GitHub Advisory Database (reviewed) High CVE-2022-26662

Packages

EcosystemPackageAffectedFixed in
PyPI trytond >= 5.0.0, < 5.0.46 5.0.46
PyPI trytond >= 6.0.0, < 6.0.16 6.0.16
PyPI trytond >= 6.1.0, < 6.2.6 6.2.6
PyPI proteus >= 5.0.0, < 5.0.12 5.0.12
PyPI proteus >= 6.0.0, < 6.0.5 6.0.5
PyPI proteus >= 6.1.0, < 6.2.2 6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

References

External links from the advisory. They lead to third-party sites.