CVE-2022-26662 XML Entity Expansion in trytond and proteus
An unauthenticated attacker can cause a denial of service in Tryton Application Platform by sending crafted XML-RPC messages exploiting XML Entity Expansion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26662?
CVE-2022-26662 is a high-severity vulnerability in Debian Debian Linux, published on 7 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Weakness: CWE-776
Which versions are affected by CVE-2022-26662?
15 open source packages ship an affected version, including proteus, tryton and trytond. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
proteus PyPI | From 5.0.0 | 5.0.12, 6.0.5, 6.2.2 |
proteus PyPI | From 5.0.0 | 5.0.12 |
proteus PyPI | From 5.0.0 | 5.0.12 |
proteus PyPI | From 6.0.0 | 6.0.5 |
proteus PyPI | From 6.0.0 | 6.0.5 |
proteus PyPI | From 6.1.0 | 6.2.2 |
9 more packages
proteus PyPI | From 6.1.0 | 6.2.2 |
tryton PyPI | From 5.0.0 | 5.0.12, 6.0.5, 6.2.2, 6.2.6, 6.0.16, 5.0.46 |
trytond PyPI | From 5.0.0 | 5.0.46, 6.0.16, 6.2.6 |
trytond PyPI | From 5.0.0 | 5.0.46 |
trytond PyPI | From 5.0.0 | 5.0.46 |
trytond PyPI | From 6.0.0 | 6.0.16 |
trytond PyPI | From 6.0.0 | 6.0.16 |
trytond PyPI | From 6.1.0 | 6.2.6 |
trytond PyPI | From 6.1.0 | 6.2.6 |
Products include Debian Debian Linux, Tryton Proteus, Tryton Trytond.
How do I fix CVE-2022-26662?
Upgrade proteus to a fixed version for your release line: 5.0.12, 6.0.5 or 6.2.2.
Is CVE-2022-26662 being exploited?
There is no known exploitation of CVE-2022-26662 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-26662, GHSA-pm3h-mm62-pwm8, PYSEC-2022-43171, PYSEC-2026-3392, PYSEC-2026-741, UBUNTU-CVE-2022-26662.