# Security Release for issue #12428

**URL:** https://discuss.tryton.org/t/security-release-for-issue-12428/6397
**Category:** News
**Tags:** security
**Created:** [July 31, 2023, 4:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue-12428/6397 "2023-07-31T16:00:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [July 31, 2023, 4:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue-12428/6397/1 "2023-07-31T16:00:15Z")

</div>

## Synopsis

[Edbo](https://foss.heptapod.net/edbo) and [Cédric Krier](https://foss.heptapod.net/ced) have found that [record rules are not enforced](https://foss.heptapod.net/tryton/tryton/-/issues/12428) by [trytond](https://pypi.org/project/trytond/) when only reading fields without an SQL type (like Function fields).

## Impact

[CVSS v3.0 Base Score: 6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/CR:L/MAV:N/MAC:L/MPR:L/MUI:N/MS:U/MC:L/MI:N/MA:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None

## Workaround

There is no known workaround.

## Resolution

All affected users should upgrade `trytond` to the latest version.

Affected versions per series:

- `trytond`:
  - 6.8: \<= 6.8.2
  - 6.6: \<= 6.6.10
  - 6.0: \<= 6.0.33
  - 5.0: \<= 5.0.59

Non affected versions per series:

- `trytond`:
  - 6.8: \>= 6.8.3
  - 6.6: \>= 6.6.11
  - 6.0: \>= 6.0.34
  - 5.0: \>= 5.0.60

## Reference

- [Record rules not enforced when reading only fields without SQL type (#12428) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/issue12428)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.

---

<div class="post-metadata">

### Author: ![pokoli](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/pokoli/32/22_2.png) [@pokoli](https://discuss.tryton.org/u/pokoli)
#### Post date: [August 1, 2023, 9:13am UTC](https://discuss.tryton.org/t/security-release-for-issue-12428/6397/2 "2023-08-01T09:13:21Z")

</div>

A post was split to a new topic: [Packages not found on download cdn](https://discuss.tryton.org/t/packages-not-found-on-download-cdn/6400)

---

<div class="post-metadata">

### Author: ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)
#### Post date: [August 30, 2023, 4:01pm UTC](https://discuss.tryton.org/t/security-release-for-issue-12428/6397/3 "2023-08-30T16:01:03Z")

</div>

This topic was automatically closed after 30 days. New replies are no longer allowed.