PT-2020-17159 · Python+1 · Python+2

Benoît Fontaine + 1 · Published 2020-12-22 · Updated 2025-09-25 · CVE-2020-29396

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Odoo Community versions 11.0 through 13.0 Odoo Enterprise versions 11.0 through 13.0

Description A sandboxing issue, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation.

Recommendations For Odoo Community versions 11.0 through 13.0, update to a version that includes a fix for this issue. For Odoo Enterprise versions 11.0 through 13.0, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-267

Related Identifiers

BIT-ODOO-2020-29396

CVE-2020-29396

Affected Products

Odoo Community

Odoo Enterprise

Python

References · 10

• https://github.com/odoo/odoo/issues/63712 · Patch
• https://cve.org/CVERecord?id=CVE-2020-29396 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-29396 · Security Note
• https://osv.dev/vulnerability/BIT-odoo-2020-29396 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29396 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29396 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29396 · Vendor Advisory
• https://twitter.com/dailycve/status/1971276275970081195 · Twitter Post
• https://t.me/cibsecurity/21176 · Telegram Post