PT-2018-14964 · Tryton+1 · Tryton+1

Cédric Krier · Publicado 2018-11-22 · Atualizado 2018-12-22 · CVE-2018-19443

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Tryton versions 5.0.0

Description The issue arises when the client attempts to establish a connection to the bus in cleartext instead of using encryption under specific circumstances, as seen in bus.py and jsonrpc.py. Although the connection attempt fails, it includes the current user session in the header, making it susceptible to session theft by a man-in-the-middle.

Recommendations For Tryton version 5.0.0, update to version 5.0.1 to resolve the issue.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2018-19443

GHSA-32W7-9WHP-CJP9

OPENSUSE-SU-2018_4242-1

OPENSUSE-SU-2018_4248-1

PYSEC-2018-77

Produtos afetados

Suse

Tryton

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/tryton/PYSEC-2018-77.yaml · Nota
• https://ubuntu.com/security/CVE-2018-19443 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19443 · Nota de Segurança
• https://discuss.tryton.org/t/security-release-for-issue7792/830 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19443 · Aviso do Fabricante
• https://github.com/advisories/GHSA-32w7-9whp-cjp9 · Nota
• https://osv.dev/vulnerability/PYSEC-2018-77 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-19443 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-32w7-9whp-cjp9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-19443 · Aviso do Fabricante
• https://bugs.tryton.org/issue7792 · Nota