Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-7ptr-cub3-3yeq

Summary An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

Aliases

alias	CVE-2022-26662

alias	GHSA-pm3h-mm62-pwm8

alias	PYSEC-2022-43171

Fixed_packages

url	pkg:pypi/proteus@5.0.12
purl	pkg:pypi/proteus@5.0.12
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@5.0.12

url	pkg:pypi/proteus@6.0.5
purl	pkg:pypi/proteus@6.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.0.5

url	pkg:pypi/proteus@6.2.2
purl	pkg:pypi/proteus@6.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.2.2

url	pkg:pypi/tryton@5.0.12
purl	pkg:pypi/tryton@5.0.12
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.12

url	pkg:pypi/tryton@5.0.46
purl	pkg:pypi/tryton@5.0.46
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.46

url	pkg:pypi/tryton@6.0.5
purl	pkg:pypi/tryton@6.0.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.5

url	pkg:pypi/tryton@6.0.16
purl	pkg:pypi/tryton@6.0.16
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.16

url	pkg:pypi/tryton@6.2.2
purl	pkg:pypi/tryton@6.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.2

url	pkg:pypi/tryton@6.2.6
purl	pkg:pypi/tryton@6.2.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.6

url	pkg:pypi/trytond@5.0.46
purl	pkg:pypi/trytond@5.0.46
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@5.0.46

url	pkg:pypi/trytond@6.0.16
purl	pkg:pypi/trytond@6.0.16
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.0.16

url	pkg:pypi/trytond@6.2.6
purl	pkg:pypi/trytond@6.2.6
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.2.6

Affected_packages

url pkg:pypi/proteus@5.0.0

purl pkg:pypi/proteus@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@5.0.0

url pkg:pypi/proteus@6.0.0

purl pkg:pypi/proteus@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.0.0

url pkg:pypi/proteus@6.1.0

purl pkg:pypi/proteus@6.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/proteus@6.1.0

url pkg:pypi/tryton@5.0.0

purl pkg:pypi/tryton@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-b7zr-zrzn-w3ej

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.0

url pkg:pypi/tryton@5.0.1

purl pkg:pypi/tryton@5.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.1

url pkg:pypi/tryton@5.0.2

purl pkg:pypi/tryton@5.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.2

url pkg:pypi/tryton@5.0.3

purl pkg:pypi/tryton@5.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.3

url pkg:pypi/tryton@5.0.4

purl pkg:pypi/tryton@5.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.4

url pkg:pypi/tryton@5.0.5

purl pkg:pypi/tryton@5.0.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.5

url pkg:pypi/tryton@5.0.6

purl pkg:pypi/tryton@5.0.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.6

url pkg:pypi/tryton@5.0.7

purl pkg:pypi/tryton@5.0.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.7

url pkg:pypi/tryton@5.0.8

purl pkg:pypi/tryton@5.0.8

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.8

url pkg:pypi/tryton@5.0.9

purl pkg:pypi/tryton@5.0.9

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.9

url pkg:pypi/tryton@5.0.10

purl pkg:pypi/tryton@5.0.10

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.10

url pkg:pypi/tryton@5.0.11

purl pkg:pypi/tryton@5.0.11

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@5.0.11

url pkg:pypi/tryton@6.0.0

purl pkg:pypi/tryton@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.0

url pkg:pypi/tryton@6.0.1

purl pkg:pypi/tryton@6.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.1

url pkg:pypi/tryton@6.0.2

purl pkg:pypi/tryton@6.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.2

url pkg:pypi/tryton@6.0.3

purl pkg:pypi/tryton@6.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.3

url pkg:pypi/tryton@6.0.4

purl pkg:pypi/tryton@6.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.0.4

url pkg:pypi/tryton@6.2.0

purl pkg:pypi/tryton@6.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.0

url pkg:pypi/tryton@6.2.1

purl pkg:pypi/tryton@6.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/tryton@6.2.1

url pkg:pypi/trytond@6.0.0

purl pkg:pypi/trytond@6.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-7y7d-usj9-4bc4

vulnerability	VCID-aa7x-ejc8-7bfz

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.0.0

url pkg:pypi/trytond@6.2.0

purl pkg:pypi/trytond@6.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@6.2.0

url pkg:pypi/trytond@5.0.0

purl pkg:pypi/trytond@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-7ptr-cub3-3yeq

vulnerability	VCID-kjnf-nmzs-c7b5

vulnerability	VCID-te21-ks2b-dfhy

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/trytond@5.0.0

References

reference_url

https://bugs.tryton.org/issue11244

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://bugs.tryton.org/issue11244

reference_url

https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059

reference_url

https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html

reference_url

https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html

reference_url

https://www.debian.org/security/2022/dsa-5098

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://www.debian.org/security/2022/dsa-5098

reference_url

https://www.debian.org/security/2022/dsa-5099

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

url

https://www.debian.org/security/2022/dsa-5099

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2022-26662
reference_id	CVE-2022-26662
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2022-26662

reference_url	https://github.com/advisories/GHSA-pm3h-mm62-pwm8
reference_id	GHSA-pm3h-mm62-pwm8
reference_type
scores
url	https://github.com/advisories/GHSA-pm3h-mm62-pwm8

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	776
name	Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
description	The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score 7.5 - 7.5

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7ptr-cub3-3yeq

Vulnerability Instance