CVE-2022-26661 Improper Restriction of XML External Entity Reference in trytond and proteus
An authenticated user can exploit an XML External Entity vulnerability in Tryton to access arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26661?
CVE-2022-26661 is a medium-severity vulnerability in Debian Debian Linux, published on 7 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Weakness: CWE-611
Which versions are affected by CVE-2022-26661?
15 open source packages ship an affected version, including proteus, tryton and trytond. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
proteus PyPI | From 5.0.0 | 5.0.12, 6.0.5, 6.2.2 |
proteus PyPI | From 5.0.0 | 5.0.12 |
proteus PyPI | From 5.0.0 | 5.0.12 |
proteus PyPI | From 6.0.0 | 6.0.5 |
proteus PyPI | From 6.0.0 | 6.0.5 |
proteus PyPI | From 6.1.0 | 6.2.2 |
9 more packages
proteus PyPI | From 6.1.0 | 6.2.2 |
tryton PyPI | From 5.0.0 | 5.0.12, 6.0.5, 6.2.2, 6.2.6, 6.0.16, 5.0.46 |
trytond PyPI | From 5.0.0 | 5.0.46, 6.0.16, 6.2.6 |
trytond PyPI | From 5.0.0 | 5.0.46 |
trytond PyPI | From 5.0.0 | 5.0.46 |
trytond PyPI | From 6.0.0 | 6.0.16 |
trytond PyPI | From 6.0.0 | 6.0.16 |
trytond PyPI | From 6.1.0 | 6.2.6 |
trytond PyPI | From 6.1.0 | 6.2.6 |
Products include Debian Debian Linux, Tryton Proteus, Tryton Trytond.
How do I fix CVE-2022-26661?
Upgrade proteus to a fixed version for your release line: 5.0.12, 6.0.5 or 6.2.2.
Is CVE-2022-26661 being exploited?
There is no known exploitation of CVE-2022-26661 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-26661, GHSA-cj78-rgw3-4h5p, PYSEC-2022-43170, PYSEC-2026-3391, PYSEC-2026-740, UBUNTU-CVE-2022-26661.