PT-2017-11515 · Psycopg+1 · Psycopg+1

Benkuhn · Publicado 2017-07-04 · Atualizado 2017-07-12 · CVE-2017-10804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Odoo versions 8.0, 9.0, and 10.0 Odoo Community Edition versions 9.0 and 10.0 Odoo Enterprise Edition versions 9.0 and 10.0

Description The issue allows remote attackers to bypass authentication under certain circumstances. This happens because parameters containing 0x00 characters are truncated before reaching the database layer due to the use of Psycopg 2.x before 2.6.3.

Recommendations For Odoo versions 8.0, 9.0, and 10.0, consider updating Psycopg to version 2.6.3 or later to prevent parameter truncation. For Odoo Community Edition versions 9.0 and 10.0, update Psycopg to version 2.6.3 or later. For Odoo Enterprise Edition versions 9.0 and 10.0, update Psycopg to version 2.6.3 or later.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2017-10804

Produtos afetados

Odoo

Psycopg

Referências · 5

• 🔥 https://github.com/psycopg/psycopg2/issues/420 · Exploit
• https://github.com/odoo/odoo/issues/17914 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-10804 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-10804 · Aviso do Fabricante
• http://initd.org/psycopg/docs/news.html#what-s-new-in-psycopg-2-6-3 · Nota