Debian Security Advisory

DLA-70-1 tryton-server -- LTS security update

Date Reported:
05 Oct 2014
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2014-6633.
More information:

duesenfranz discovered, that safe_eval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safe_eval and avoid double evaluation from inherit with a different model.

For Debian 6 Squeeze, these issues have been fixed in tryton-server version 1.6.1-2+squeeze2