GitHub Advisoryadvisory · PyPI

GHSA-m9jj-5qvj-5fhx Tryton vulnerable to arbitrary command execution

HIGH Published 2022-05-14 Modified 2024-11-18 Official page ↗
Aliases
CVE-2014-6633
Ecosystem
PyPI
Packages
tryton, trytond
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2024-04-29

Affected packages

• PyPI tryton: < 2.4.15 → fixed in 2.4.15 • PyPI tryton: >= 2.6.0, < 2.6.14 → fixed in 2.6.14 • PyPI tryton: >= 2.8.0, < 2.8.11 → fixed in 2.8.11 • PyPI tryton: >= 3.2.0, < 3.2.3 → fixed in 3.2.3 • PyPI trytond: >= 2.4.0, < 2.4.15 → fixed in 2.4.15 • PyPI trytond: >= 2.6.0, < 2.6.14 → fixed in 2.6.14 • PyPI trytond: >= 2.8.0, < 2.8.11 → fixed in 2.8.11 • PyPI trytond: >= 3.2.0, < 3.2.3 → fixed in 3.2.3 • PyPI trytond: >= 3.0.0, < 3.0.7 → fixed in 3.0.7

Description

The `safe_eval` function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the `collection.domain` in the webdav module or (2) the formula field in the `price_list` module.

Related

Alias · CVE (1)

  • CVE-2014-6633 The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References