Hi all, several security issues were found and are fixed in unstable, forky and trixie.
1) tryton-server: https://discuss.tryton.org/t/security-release-for-issue-14947/9302 Forbid weasyprint to access local files https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/08_restrict_weasyprint_protocol.patch?ref_type=heads The patch is applicable on tryton-server in bookworm, but requires 'weasyprint >= 68.0' while bookworm has 57.2-1. 2) https://security-tracker.debian.org/tracker/TEMP-0000000-9D9504 Python code execution via uploaded templates https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/3 https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/06_restrict_genshi_evaluation.patch?ref_type=heads The patch to restrict genshi evaluation applies, but there is a caveat: custom reports could fail, if they use the forbidden functions. This patch could be deployed. https://discuss.tryton.org/t/security-release-for-issue-14907/9267/1 https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/07_enforce_access_right_on_email_template_records.patch?ref_type=heads The changes made by those patches are rather intrusive, so this patch could not be deployed IMO. Please advise how to proceed further. Cheers, Mathias -- Mathias Behrle PGP/GnuPG key availabable from any keyserver, ID: 0xD6D09BE48405BBF6 AC29 7E5C 46B9 D0B6 1C71 7681 D6D0 9BE4 8405 BBF6
