Debian Long Term Support / LTS Security Information / 2014 / Security Information -- DLA-70-1 tryton-server

Debian Security Advisory

DLA-70-1 tryton-server -- LTS security update

Date Reported:

05 Oct 2014

Affected Packages:

tryton-server

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2014-6633.

More information:

duesenfranz discovered, that safe_eval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safe_eval and avoid double evaluation from inherit with a different model.

For Debian 6 Squeeze, these issues have been fixed in tryton-server version 1.6.1-2+squeeze2