The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of     encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it     contains in the header the current session of the user. This session could then be stolen by a man-in-the-     middle. (CVE-2018-19443)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of
    encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it
    contains in the header the current session of the user. This session could then be stolen by a man-in-the-
    middle. (CVE-2018-19443)

This update for tryton to version 4.2.19 fixes the following issues :

Security issue fixed :

  - CVE-2018-19443: Fixed an information leakage by     attemping to initiate an unencrypted connection, which     would fail eventually, but might leak session     information of the user (boo#1117105)

This update also contains newer versions of tryton related packages with general bug fixes and updates :

  - trytond 4.2.17

  - trytond_account 4.2.10

  - trytond_account_invoice 4.2.7

  - trytond_purchase_request 4.2.4

  - trytond_stock 4.2.8

  - trytond_stock_supply 4.2.3

This update for tryton to version 4.2.19 fixes the following issues (boo#1107771) :

Security issue fixed :

  - CVE-2018-19443: Fixed an information leakage by     attemping to initiate an unencrypted connection, which     would fail eventually, but might leak session     information of the user (boo#1117105)

This update also contains newer versions of tryton related packages with general bug fixes and updates :

  - trytond 4.2.17

  - trytond_account 4.2.10

  - trytond_account_invoice 4.2.7

  - trytond_currency 4.2.2

  - trytond_purchase 4.2.6

  - trytond_purchase_request 4.2.4

  - trytond_stock 4.2.8

  - trytond_stock_supply 4.2.3

ID	Name	Product	Family	Severity
259860	Linux Distros Unpatched Vulnerability : CVE-2018-19443	Nessus	Misc.	medium
422337	SCA: security update for tryton (GHSA-32w7-9whp-cjp9)	Tenable Cloud Security	SCA Checks	high
422337	SCA: security update for tryton (GHSA-32w7-9whp-cjp9)	Tenable Self-Hosted Container Security	SCA Checks	high
123154	openSUSE Security Update : tryton (openSUSE-2019-1013)	Nessus	SuSE Local Security Checks	medium
119856	openSUSE Security Update : tryton (openSUSE-2018-1588)	Nessus	SuSE Local Security Checks	medium
119855	openSUSE Security Update : tryton (openSUSE-2018-1587)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-19443

high

Tenable Plugins

medium

high

high

medium

medium

medium