CVE-2014-6633 Tryton vulnerable to arbitrary command execution
Remote authenticated users can execute arbitrary commands via shell metacharacters in specific Tryton fields, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-6633?
CVE-2014-6633 is a high-severity command injection vulnerability in n/a, published on 12 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.
Weakness: CWE-77
Which versions are affected by CVE-2014-6633?
20 open source packages ship an affected version, including trytond and tryton. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
trytond PyPI | From 2.4.0 | 2.4.15, 2.6.14, 2.8.11, 3.0.7, 3.2.3 |
trytond PyPI | From 2.4.0 | 2.4.15 |
trytond PyPI | From 2.4.0 | 2.4.15 |
trytond PyPI | From 2.6.0 | 2.6.14 |
trytond PyPI | From 2.6.0 | 2.6.14 |
trytond PyPI | From 2.8.0 | 2.8.11 |
14 more packages
trytond PyPI | From 2.8.0 | 2.8.11 |
trytond PyPI | From 3.0.0 | 3.0.7 |
trytond PyPI | From 3.0.0 | 3.0.7 |
trytond PyPI | From 3.2.0 | 3.2.3 |
trytond PyPI | From 3.2.0 | 3.2.3 |
tryton PyPI | All versions | 2.4.15, 2.6.14, 2.8.11, 3.2.3 |
tryton PyPI | All versions | 2.4.15 |
tryton PyPI | All versions | 2.4.15 |
tryton PyPI | From 2.6.0 | 2.6.14 |
tryton PyPI | From 2.6.0 | 2.6.14 |
tryton PyPI | From 2.8.0 | 2.8.11 |
tryton PyPI | From 2.8.0 | 2.8.11 |
tryton PyPI | From 3.2.0 | 3.2.3 |
tryton PyPI | From 3.2.0 | 3.2.3 |
Products include Tryton Tryton.
How do I fix CVE-2014-6633?
Upgrade trytond to a fixed version for your release line: 2.4.15, 2.6.14, 2.8.11 or 3.0.7.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-6633 being exploited?
There is no known exploitation of CVE-2014-6633 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2013-4510 Tryton Directory Traversal vulnerability
- CVE-2018-19443 Session Fixation in Tryton
- CVE-2017-0360 Tryton Information Disclosure Vulnerability
- CVE-2016-1241 Tryton allows users to read the hashed password
- CVE-2016-1242 Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter
Sources
Also known as DEBIAN-CVE-2014-6633, DLA-70-1, DSA-3043-1, GHSA-m9jj-5qvj-5fhx, PYSEC-2018-59, PYSEC-2026-3390.