# Security Release for issue11219 and issue11244

**URL:** <https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059>\
**Category:** News\
**Tags:** security\
**Created:** [March 3, 2022, 10:58am UTC](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059 "2022-03-03T10:58:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\
**Post date:** [March 3, 2022, 10:58am UTC](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059/1 "2022-03-03T10:58:04Z")

</div>

## Synopsis

XML parsing vulnerabilities have been found by [Jeremy Mousset](https://discuss.tryton.org/u/jeremy.mousset) in [trytond](https://pypi.org/project/trytond/) and some modules.  
With [issue11219](https://bugs.tryton.org/issue11219) an authenticated user can make the server to parse a crafted XML SEPA file to access arbitrary files on the system.  
With [issue11244](https://bugs.tryton.org/issue11244) an non authenticated user can sent a crafted XML-RPC message to consume all the resources of the server.

## Impact

### issue11219

[CVSS v3.0 Base Score: 6.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None

### issue11244

[CVSS v3.0 Base Score: 7.5](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality: None
- Integrity: None
- Availability: High

## Workaround

It is possible to activate [defusedxml](https://pypi.org/project/defusedxml/), define default [lxml](https://pypi.org/project/lxml/) parsers that does not resolve entities and upgrade expat to 2.4.1 or newer.

## Resolution

All affected users should upgrade `trytond` and `proteus` to the latest version.

Affected versions per series:

- `trytond`:

- `proteus`

Non affected versions per series:

- `trytond`:

- `proteus`:

## Reference

- [A user can read the content of files on the machine running trytond by exploiting XEE vulnerability in camt54 parsing (#11219) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/issue11219)
- [A non authenticated user can cause a denial of service with a single request using an xml bomb attack on xmlrpc (#11244) · Issues · Tryton / Tryton · GitLab](https://bugs.tryton.org/issue11244)

## Concern?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/](https://bugs.tryton.org/) with the type **`security`**.

---

<div class="post-metadata">

**Author:** ![yangoon](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/y/67e7ee/32.png) [@yangoon](https://discuss.tryton.org/u/yangoon)\
**Post date:** [March 9, 2022, 8:41am UTC](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059/2 "2022-03-09T08:41:57Z")

</div>

**CVE**

FTR I requested CVE numbers from [mitre.org](http://mitre.org).

Please use  
[CVE-2022-26661](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26661) for [issue11219](https://bugs.tryton.org/issue11219)  
and  
[CVE-2022-26662](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26662) for [issue11244](https://bugs.tryton.org/issue11244)

---

<div class="post-metadata">

**Author:** ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)\
**Post date:** [April 2, 2022, 10:58am UTC](https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059/3 "2022-04-02T10:58:22Z")

</div>

Closed on April 2, 2022, 10:58am UTC

This topic was automatically closed after 30 days. New replies are no longer allowed.