-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 02 Sep 2026 15:11:59 +0200 Source: tryton-server Architecture: source Version: 7.0.30-1+deb13u2 Distribution: trixie-security Urgency: high Maintainer: Debian Tryton Maintainers <[email protected]> Changed-By: Mathias Behrle <[email protected]> Changes: tryton-server (7.0.30-1+deb13u2) trixie-security; urgency=high . * Add 06_restrict_genshi_evaluation.patch. From https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869: Security Release for issue #5160 and #14869 The user titou has discovered that the administrator group can execute Python code on the server which is hidden inside an uploaded report template. And Dan Shallom has discovered that the same can also be accomplished by the marketing group when uploading marketing email templates. This patch also contains the subsequent fixes from https://bugs.tryton.org/14928, https://bugs.tryton.org/14932 * Add 07_enforce_access_right_on_email_template_records.patch. From https://discuss.tryton.org/t/security-release-for-issue-14907: Cédric Krier has discovered that access is not enforced when browsing record instances in templates. This patch also contains the required patch adding ModelAccessProxy https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 * Add 08_restrict_weasyprint_protocol.patch. From https://discuss.tryton.org/t/security-release-for-issue-14947: Cédric Krier has discovered that Tryton does not prevent weasyprint to access local files when rendering HTML report to PDF. https://foss.heptapod.net/tryton/tryton/-/work_items/14947 The weasyprint documentation states that it can be used to access local files. Checksums-Sha1: 131afdee88aa9c246a8851c24e0dbf51a6fb41a8 2703 tryton-server_7.0.30-1+deb13u2.dsc 43eab328667c21d77ddd664b8725209ca3858e08 61184 tryton-server_7.0.30-1+deb13u2.debian.tar.xz e8773d62021dd4da084cdfa7663394a14c13188e 10638 tryton-server_7.0.30-1+deb13u2_amd64.buildinfo Checksums-Sha256: 6339f20372d47b544f097bea860dbac07eaa89533d386cfb247897e94017eb52 2703 tryton-server_7.0.30-1+deb13u2.dsc 3bce465d954d053ce9db7b14c6e8f9eaf1683014e6c9036a35a63c69a39d428e 61184 tryton-server_7.0.30-1+deb13u2.debian.tar.xz 6903c10bac6931fa7dc061b58901e8766e472511d3d2edd5461c5bcd4a05416f 10638 tryton-server_7.0.30-1+deb13u2_amd64.buildinfo Files: 2a7b64106999be60a26e1dde1544fbe9 2703 python optional tryton-server_7.0.30-1+deb13u2.dsc 27851d8fe8825f1ea31f5f8898eef80d 61184 python optional tryton-server_7.0.30-1+deb13u2.debian.tar.xz 78d7700727f2d91de509b4f224642c6a 10638 python optional tryton-server_7.0.30-1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- Comment: Signed by Mathias Behrle iQJFBAEBCgAvFiEErCl+XEa50LYccXaB1tCb5IQFu/YFAmqYI9gRHG1hdGhpYXNi QG05cy5iaXoACgkQ1tCb5IQFu/bxjRAApoGxIZb2lWR8yolhfDjrsBQ/gx1phhTV ZdPMyHdlGTnmFdOgM3lRhUtQcRizhoYqIsKUsJNWhHDHO76BY99TTZq9TChkl0Ud 2x+CX+/P070E2GrwIje9/eg1Xhj6frNP7dVrcRV0IRHjbt9eKOd4eULYEbQrrIFD J6pJgrWptNAWi9452qVEzOeC3IAyujmbOe/2f+BwxyQ9LwNlbC5BoyPfeVtHTjgJ 7iInRftdbRiWPpS7LvizxzfpQUHJmUP9m4q88qGaxkqcYyTj03G2tZ/+vERyppQa eyv1lOj1S/qewtubs+rziDDe/eNN39BmI1WWkz0kRc6RLENVsLaInXW8X9riAgo9 JTV2Vflvq0MnfFbb2+vlGt1xiJKCrpcQTsQQg/BYXUZq+knGbBBYJ164JoPcaHkL O78JUNyrFJhvqmkZp/VK61adjHMQGfdnNbxHTRcOI6gVovPutCMnNXHA6XqFs9qM gH781hmDkuHX1q/5ROLClyAk0ympz4Bq3caZTt+ZujDljDKmDGN5uzGYOMDhps5p X5w6Ni6J+ICWJVsx7FA86og/RHUFJrZ1BrahTVykAgZbylG9rlQl38zLM30kUwQy ecD7D+UVuw7OkORureR2Cb/xthoEEl/vwiI25mUpnHFNn++ZgWNtozCD+91k2aa0 UPofUeqpEQI= =VLRA -----END PGP SIGNATURE-----
pgpNfoFg1QC35.pgp
Description: PGP signature
