-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 02 Sep 2026 15:11:59 +0200
Source: tryton-server
Architecture: source
Version: 7.0.30-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Debian Tryton Maintainers <team+tryton-team@tracker.debian.org>
Changed-By: Mathias Behrle <mathiasb@m9s.biz>
Changes:
tryton-server (7.0.30-1+deb13u2) trixie-security; urgency=high
.
* Add 06_restrict_genshi_evaluation.patch.
From https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869:
Security Release for issue #5160 and #14869
The user titou has discovered that the administrator group can execute
Python code on the server which is hidden inside an uploaded report template.
And Dan Shallom has discovered that the same can also be accomplished by
the marketing group when uploading marketing email templates.
This patch also contains the subsequent fixes from
https://bugs.tryton.org/14928, https://bugs.tryton.org/14932
* Add 07_enforce_access_right_on_email_template_records.patch.
From https://discuss.tryton.org/t/security-release-for-issue-14907:
Cédric Krier has discovered that access is not enforced when browsing
record instances in templates.
This patch also contains the required patch adding ModelAccessProxy
https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431
* Add 08_restrict_weasyprint_protocol.patch.
From https://discuss.tryton.org/t/security-release-for-issue-14947:
Cédric Krier has discovered that Tryton does not prevent weasyprint
to access local files when rendering HTML report to PDF.
https://foss.heptapod.net/tryton/tryton/-/work_items/14947
The weasyprint documentation states that it can be used to access local files.
Checksums-Sha1:
131afdee88aa9c246a8851c24e0dbf51a6fb41a8 2703 tryton-server_7.0.30-1+deb13u2.dsc
43eab328667c21d77ddd664b8725209ca3858e08 61184 tryton-server_7.0.30-1+deb13u2.debian.tar.xz
e8773d62021dd4da084cdfa7663394a14c13188e 10638 tryton-server_7.0.30-1+deb13u2_amd64.buildinfo
Checksums-Sha256:
6339f20372d47b544f097bea860dbac07eaa89533d386cfb247897e94017eb52 2703 tryton-server_7.0.30-1+deb13u2.dsc
3bce465d954d053ce9db7b14c6e8f9eaf1683014e6c9036a35a63c69a39d428e 61184 tryton-server_7.0.30-1+deb13u2.debian.tar.xz
6903c10bac6931fa7dc061b58901e8766e472511d3d2edd5461c5bcd4a05416f 10638 tryton-server_7.0.30-1+deb13u2_amd64.buildinfo
Files:
2a7b64106999be60a26e1dde1544fbe9 2703 python optional tryton-server_7.0.30-1+deb13u2.dsc
27851d8fe8825f1ea31f5f8898eef80d 61184 python optional tryton-server_7.0.30-1+deb13u2.debian.tar.xz
78d7700727f2d91de509b4f224642c6a 10638 python optional tryton-server_7.0.30-1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
Comment: Signed by Mathias Behrle
iQJFBAEBCgAvFiEErCl+XEa50LYccXaB1tCb5IQFu/YFAmqYI9gRHG1hdGhpYXNi
QG05cy5iaXoACgkQ1tCb5IQFu/bxjRAApoGxIZb2lWR8yolhfDjrsBQ/gx1phhTV
ZdPMyHdlGTnmFdOgM3lRhUtQcRizhoYqIsKUsJNWhHDHO76BY99TTZq9TChkl0Ud
2x+CX+/P070E2GrwIje9/eg1Xhj6frNP7dVrcRV0IRHjbt9eKOd4eULYEbQrrIFD
J6pJgrWptNAWi9452qVEzOeC3IAyujmbOe/2f+BwxyQ9LwNlbC5BoyPfeVtHTjgJ
7iInRftdbRiWPpS7LvizxzfpQUHJmUP9m4q88qGaxkqcYyTj03G2tZ/+vERyppQa
eyv1lOj1S/qewtubs+rziDDe/eNN39BmI1WWkz0kRc6RLENVsLaInXW8X9riAgo9
JTV2Vflvq0MnfFbb2+vlGt1xiJKCrpcQTsQQg/BYXUZq+knGbBBYJ164JoPcaHkL
O78JUNyrFJhvqmkZp/VK61adjHMQGfdnNbxHTRcOI6gVovPutCMnNXHA6XqFs9qM
gH781hmDkuHX1q/5ROLClyAk0ympz4Bq3caZTt+ZujDljDKmDGN5uzGYOMDhps5p
X5w6Ni6J+ICWJVsx7FA86og/RHUFJrZ1BrahTVykAgZbylG9rlQl38zLM30kUwQy
ecD7D+UVuw7OkORureR2Cb/xthoEEl/vwiI25mUpnHFNn++ZgWNtozCD+91k2aa0
UPofUeqpEQI=
=VLRA
-----END PGP SIGNATURE-----
