Security Release for issue #5160 and #14869

News
1

The user titou has discovered that the administrator group can execute Python code on the server which is hidden inside an uploaded report template.
And Dan Shallom has discovered that the same can also be accomplished by the marketing group when uploading marketing email templates.

Impact

CVSS v3.0 Base Score: 6.5

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality: High
  • Integrity: None
  • Availability: None

Workaround

There is no workaround.

Resolution

All affected users should upgrade trytond to the latest version.

Affected versions per series:

  • trytond:
    • 8.0: <= 8.0.5
    • 7.8: <= 7.8.11
    • 7.0: <= 7.0.52

Not affected versions per series:

  • trytond:
    • 8.0: >= 8.0.6
    • 7.8: >= 7.8.12
    • 7.0: >= 7.0.53

Some custom reports may fail after the upgrade because they are using dynamic or private attributes. Such reports must be updated to use only the allowed statements.

Reference

Concerns?

Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the confidential checkbox checked.

2

FTR, one of the commits is about restricting Genshi evaluation, so make sure to check your reports. They will now fail with UndefinedError: "X" not defined if they use anything outside the allowed built-ins like getattr.

3

FTR, some reports on Tryton use those build-ins so they are already failing.