# Security Release for issue7792

**URL:** https://discuss.tryton.org/t/security-release-for-issue7792/830
**Category:** News
**Tags:** security
**Created:** [October 31, 2018, 1:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue7792/830 "2018-10-31T13:00:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [October 31, 2018, 1:00pm UTC](https://discuss.tryton.org/t/security-release-for-issue7792/830/1 "2018-10-31T13:00:01Z")

</div>

## Synopsis

A vulnerability in [tryton](https://pypi.org/project/tryton/) has been found by [Cédric Krier](https://bugs.tryton.org/user3).

With [issue7792](https://bugs.tryton.org/issue7792) the client tries to make the connection to the [bus](http://docs.tryton.org/projects/server/en/latest/ref/bus.html#bus) in plain text instead of encrypted. The connection tentative fails, but it contains in the header the current session of the user. This session could then be stolen by a [man-in-the-middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack).

## Impact

[CVSS v3.0 Base Score: 4.2](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality: Low
- Integrity: Low
- Availability: None

## Workaround

There are no known workarounds.

## Resolution

All affected users should upgrade `tryton` to the latest version.  
It is recommended that users change their password to clear all existing sessions (the password itself has not been compromised).  
Only series 5.0 has the component subject to the issue.  
Affected versions per series: =5.0.0  
Non affected versions per series: \>=5.0.1

## Reference

- [issue7792](https://bugs.tryton.org/issue7792)

## Concern?

Any security concerns should be reported on the bug-tracker at  
[https://bugs.tryton.org/](https://bugs.tryton.org/) with the type `security`.

---

<div class="post-metadata">

### Author: ![yangoon](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/y/67e7ee/32.png) [@yangoon](https://discuss.tryton.org/u/yangoon)
#### Post date: [November 23, 2018, 12:41pm UTC](https://discuss.tryton.org/t/security-release-for-issue7792/830/2 "2018-11-23T12:41:56Z")

</div>

CVE-2018-19443 was assigned directly from MITRE by request from Debian for

> [@Security Release for issue7792](https://discuss.tryton.org/t/security-release-for-issue7792/830):
>
> Synopsis A vulnerability in [tryton](https://pypi.org/project/tryton/) has been found by [Cédric Krier](https://bugs.tryton.org/user3). With [issue7792](https://bugs.tryton.org/issue7792) the client tries to make the connection to the [bus](http://docs.tryton.org/projects/server/en/latest/ref/bus.html#bus) in plain text instead of encrypted. The connection tentative fails, but it contains in the header the current session of the user. This session could then be stolen by a [man-in-the-middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Impact [CVSS v3.0 Base Score: 4.2](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Int…

> **[Bus fails on ssl connection (#7792) · Issues · Tryton / Tryton · GitLab](https://foss.heptapod.net/tryton/tryton/-/issues/7792)**
>
> The bus is started before a connection is set so the ssl property returns always false. So the Bus always try to connect without SSL. For me,...