GitHub Advisoryadvisory · PyPI

GHSA-32w7-9whp-cjp9 Session Fixation in Tryton

HIGH Published 2018-11-29 Modified 2024-11-13 Official page ↗
Aliases
CVE-2018-19443
Ecosystem
PyPI
Packages
tryton
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-384
Reviewed
2020-06-16

Affected packages

• PyPI tryton: >= 5.0.0, < 5.0.1 → fixed in 5.0.1

Description

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

Related

Alias · CVE (1)

  • CVE-2018-19443 The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References