CVE-2022-26661
CVE-2022-26661
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
CVSS 6.5 · Medium · EPSS 1.4% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
tryton-proteus Debian:12
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-proteus Debian:13
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-proteus Debian:14
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-server Debian:12
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
tryton-server Debian:13
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
tryton-server Debian:14
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
trytond PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.14
- 5.0.15
- 5.0.16
- 5.0.17
- 5.0.18
- 5.0.19
- 5.0.2
- 5.0.20
- 5.0.21
- 5.0.22
- 5.0.23
- 5.0.24
- 5.0.25
- 5.0.26
- 5.0.27
- 5.0.28
- 5.0.29
- 5.0.3
- 5.0.30
- 5.0.31
- 5.0.32
- 5.0.33
- 5.0.34
- 5.0.35
- 5.0.36
- 5.0.37
- 5.0.38
- 5.0.39
- 5.0.4
- 5.0.40
- 5.0.41
- 5.0.42
- 5.0.43
- 5.0.44
- 5.0.45
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.46
Update to 5.0.46
trytond PyPI
- Versions
- 6.0.0
- 6.0.1
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.0.9
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 6.0.16
Update to 6.0.16
trytond PyPI
- Versions
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- Affected ranges
- ECOSYSTEM: ≥ 6.1.0, < 6.2.6
Update to 6.2.6
proteus PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.12
Update to 5.0.12
proteus PyPI
- Versions
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 6.0.5
Update to 6.0.5
proteus PyPI
- Versions
- 6.2.0
- 6.2.1
- Affected ranges
- ECOSYSTEM: ≥ 6.1.0, < 6.2.2
Update to 6.2.2
tryton PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.2.0
- 6.2.1
- Affected ranges
- {"events": [{"introduced": "5.0.0"}, {"fixed": "5.0.12"}, {"introduced": "6.0.0"}, {"fixed": "6.0.5"}, {"introduced": "6.2.0"}, {"fixed": "6.2.2"}, {"fixed": "6.2.6"}, {"fixed": "6.0.16"}, {"fixed": "5.0.46"}], "type": "ECOSYSTEM"}
Update to 5.0.12; Update to 6.0.5; Update to 6.2.2; Update to 6.2.6; Update to 6.0.16; Update to 5.0.46
trytond PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.14
- 5.0.15
- 5.0.16
- 5.0.17
- 5.0.18
- 5.0.19
- 5.0.2
- 5.0.20
- 5.0.21
- 5.0.22
- 5.0.23
- 5.0.24
- 5.0.25
- 5.0.26
- 5.0.27
- 5.0.28
- 5.0.29
- 5.0.3
- 5.0.30
- 5.0.31
- 5.0.32
- 5.0.33
- 5.0.34
- 5.0.35
- 5.0.36
- 5.0.37
- 5.0.38
- 5.0.39
- 5.0.4
- 5.0.40
- 5.0.41
- 5.0.42
- 5.0.43
- 5.0.44
- 5.0.45
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.0.9
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.46 ∪ ≥ 6.0.0, < 6.0.16 ∪ ≥ 6.1.0, < 6.2.6
Update to 5.0.46; Update to 6.0.16; Update to 6.2.6
proteus PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.2.0
- 6.2.1
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.12 ∪ ≥ 6.0.0, < 6.0.5 ∪ ≥ 6.1.0, < 6.2.2
Update to 5.0.12; Update to 6.0.5; Update to 6.2.2
tryton-proteus Ubuntu:16.04:LTS
- Versions
- 3.6.1-1
- 3.8.0-1
- 3.8.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:16.04:LTS
- Versions
- 3.6.2-1
- 3.6.3-2
- 3.6.3-3
- 3.8.0-1
- 3.8.1-1
- 3.8.2-1
- 3.8.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:18.04:LTS
- Versions
- 4.4.0-4
- 4.6.0-1
- 4.6.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:18.04:LTS
- Versions
- 4.4.3-3
- 4.6.0-1
- 4.6.1-1
- 4.6.2-1
- 4.6.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:20.04:LTS
- Versions
- 5.0.3-2
- 5.0.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:20.04:LTS
- Versions
- 5.0.10-1
- 5.0.14-2
- 5.0.16-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:22.04:LTS
- Versions
- 5.0.8-1
- 6.0.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:22.04:LTS
- Versions
- 5.0.33-2
- 6.0.9-3
- 6.0.12-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://bugs.tryton.org/issue11219
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
- https://www.debian.org/security/2022/dsa-5098
- https://www.debian.org/security/2022/dsa-5099
- https://nvd.nist.gov/vuln/detail/CVE-2022-26661