# Security Release for issue #14220

**URL:** https://discuss.tryton.org/t/security-release-for-issue-14220/8823
**Category:** News
**Tags:** security
**Created:** [September 15, 2025, 7:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14220/8823 "2025-09-15T07:00:00Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [September 15, 2025, 7:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14220/8823/1 "2025-09-15T07:00:00Z")

</div>

[Luis Falcon](https://foss.heptapod.net/lfm) has found that [trytond](https://pypi.org/project/trytond/) may [log sensitive data like passwords](https://bugs.tryton.org/14220) when the logging level is set to `INFO`.

## Impact

[CVSS v3.0 Base Score: 4.2](https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/CR:L/MAV:L/MAC:L/MPR:L/MUI:R/MS:U/MC:H/MI:H/MA:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None

## Workaround

Increasing the logging level above `INFO` prevents logging of the sensitive data.

## Resolution

All affected users should upgrade `trytond` to the latest version.

Affected versions per series:

- `trytond`:
  - 7.6: \<= 7.6.6
  - 7.4: \<= 7.4.16
  - 7.0: \<= 7.0.35

Non affected versions per series:

- `trytond`:
  - 7.6: \>= 7.6.7
  - 7.4: \>= 7.4.17
  - 7.0: \>= 7.0.36

## Reference

- [Tryton server logging system show password in plain text (#14220) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/14220)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the confidential checkbox checked.

---

<div class="post-metadata">

### Author: ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)
#### Post date: [October 16, 2025, 6:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-14220/8823/2 "2025-10-16T06:00:36Z")

</div>

This topic was automatically closed after 30 days. New replies are no longer allowed.