CVE-2022-26662
CVE-2022-26662
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
CVSS 7.5 · High · EPSS 2.0% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
tryton-proteus Debian:12
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-proteus Debian:13
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-proteus Debian:14
- Affected ranges
- ECOSYSTEM: < 6.0.5-1
Update to 6.0.5-1
tryton-server Debian:12
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
tryton-server Debian:13
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
tryton-server Debian:14
- Affected ranges
- ECOSYSTEM: < 6.0.16-1
Update to 6.0.16-1
trytond PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.14
- 5.0.15
- 5.0.16
- 5.0.17
- 5.0.18
- 5.0.19
- 5.0.2
- 5.0.20
- 5.0.21
- 5.0.22
- 5.0.23
- 5.0.24
- 5.0.25
- 5.0.26
- 5.0.27
- 5.0.28
- 5.0.29
- 5.0.3
- 5.0.30
- 5.0.31
- 5.0.32
- 5.0.33
- 5.0.34
- 5.0.35
- 5.0.36
- 5.0.37
- 5.0.38
- 5.0.39
- 5.0.4
- 5.0.40
- 5.0.41
- 5.0.42
- 5.0.43
- 5.0.44
- 5.0.45
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.46
Update to 5.0.46
trytond PyPI
- Versions
- 6.0.0
- 6.0.1
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.0.9
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 6.0.16
Update to 6.0.16
trytond PyPI
- Versions
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- Affected ranges
- ECOSYSTEM: ≥ 6.1.0, < 6.2.6
Update to 6.2.6
proteus PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.12
Update to 5.0.12
proteus PyPI
- Versions
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- Affected ranges
- ECOSYSTEM: ≥ 6.0.0, < 6.0.5
Update to 6.0.5
proteus PyPI
- Versions
- 6.2.0
- 6.2.1
- Affected ranges
- ECOSYSTEM: ≥ 6.1.0, < 6.2.2
Update to 6.2.2
tryton PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.2.0
- 6.2.1
- Affected ranges
- {"events": [{"introduced": "5.0.0"}, {"fixed": "5.0.12"}, {"introduced": "6.0.0"}, {"fixed": "6.0.5"}, {"introduced": "6.2.0"}, {"fixed": "6.2.2"}, {"fixed": "6.2.6"}, {"fixed": "6.0.16"}, {"fixed": "5.0.46"}], "type": "ECOSYSTEM"}
Update to 5.0.12; Update to 6.0.5; Update to 6.2.2; Update to 6.2.6; Update to 6.0.16; Update to 5.0.46
trytond PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.14
- 5.0.15
- 5.0.16
- 5.0.17
- 5.0.18
- 5.0.19
- 5.0.2
- 5.0.20
- 5.0.21
- 5.0.22
- 5.0.23
- 5.0.24
- 5.0.25
- 5.0.26
- 5.0.27
- 5.0.28
- 5.0.29
- 5.0.3
- 5.0.30
- 5.0.31
- 5.0.32
- 5.0.33
- 5.0.34
- 5.0.35
- 5.0.36
- 5.0.37
- 5.0.38
- 5.0.39
- 5.0.4
- 5.0.40
- 5.0.41
- 5.0.42
- 5.0.43
- 5.0.44
- 5.0.45
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.2
- 6.0.3
- 6.0.4
- 6.0.5
- 6.0.6
- 6.0.7
- 6.0.8
- 6.0.9
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.46 ∪ ≥ 6.0.0, < 6.0.16 ∪ ≥ 6.1.0, < 6.2.6
Update to 5.0.46; Update to 6.0.16; Update to 6.2.6
proteus PyPI
- Versions
- 5.0.0
- 5.0.1
- 5.0.10
- 5.0.11
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 6.0.0
- 6.0.1
- 6.0.2
- 6.0.3
- 6.0.4
- 6.2.0
- 6.2.1
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.12 ∪ ≥ 6.0.0, < 6.0.5 ∪ ≥ 6.1.0, < 6.2.2
Update to 5.0.12; Update to 6.0.5; Update to 6.2.2
tryton-proteus Ubuntu:16.04:LTS
- Versions
- 3.6.1-1
- 3.8.0-1
- 3.8.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:16.04:LTS
- Versions
- 3.6.2-1
- 3.6.3-2
- 3.6.3-3
- 3.8.0-1
- 3.8.1-1
- 3.8.2-1
- 3.8.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:18.04:LTS
- Versions
- 4.4.0-4
- 4.6.0-1
- 4.6.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:18.04:LTS
- Versions
- 4.4.3-3
- 4.6.0-1
- 4.6.1-1
- 4.6.2-1
- 4.6.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:20.04:LTS
- Versions
- 5.0.3-2
- 5.0.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:20.04:LTS
- Versions
- 5.0.10-1
- 5.0.14-2
- 5.0.16-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-proteus Ubuntu:22.04:LTS
- Versions
- 5.0.8-1
- 6.0.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tryton-server Ubuntu:22.04:LTS
- Versions
- 5.0.33-2
- 6.0.9-3
- 6.0.12-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
- https://bugs.tryton.org/issue11244
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
- https://www.debian.org/security/2022/dsa-5098
- https://www.debian.org/security/2022/dsa-5099
- https://nvd.nist.gov/vuln/detail/CVE-2022-26662