Debian Security Advisory
DLA-70-1 tryton-server -- LTS security update
- Date Reported:
- 05 Oct 2014
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2014-6633.
- More information:
duesenfranz discovered, that safe_eval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safe_eval and avoid double evaluation from inherit with a different model.
For Debian 6
Squeeze, these issues have been fixed in tryton-server version 1.6.1-2+squeeze2