VDB
Sign up
HIGH7.5

PYSEC-2022-43171

Quick fix

PYSEC-2022-43171 — tryton: upgrade to the fixed version with the command below.

pip install --upgrade 'tryton>=5.0.12'

Details

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tryton
Introduced in: 5.0.0Fixed in: 5.0.12
Fixpip install --upgrade 'tryton>=5.0.12'

References