CVE-2018-19443
CVE-2018-19443
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
CVSS 8.2 · High · EPSS 1.1% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
tryton PyPI
- Versions
- 5.0.0
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.1
Update to 5.0.1
tryton-client Ubuntu:16.04:LTS
- Versions
- 3.6.2-1
- 3.6.3-1
- 3.8.2-1
- 3.8.3-1
- 3.8.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:18.04:LTS
- Versions
- 4.4.1-2
- 4.4.2-1
- 4.6.0-1
- 4.6.1-1
- 4.6.2-1
- 4.6.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:20.04:LTS
- Versions
- 5.0.12-1
- 5.0.15-1
- 5.0.17-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:22.04:LTS
- Versions
- 5.0.33-1
- 6.0.8-1
- 6.0.8-2
- 6.0.10-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:24.04:LTS
- Versions
- 6.0.28-1
- 6.0.29-1
- 6.0.34-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:25.10
- Versions
- 7.0.20-1
- 7.0.24-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:26.10
- Versions
- 7.0.31-1
- 7.0.35-1
- 7.0.41-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-client Ubuntu:26.04:LTS
- Versions
- 7.0.24-1
- 7.0.27-2
- 7.0.31-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published