Candidate: CVE-2014-6633
PublicDate: 2018-04-12 15:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6633
 https://bugs.tryton.org/issue4155
Description:
 The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before
 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3
 allows remote authenticated users to execute arbitrary commands via shell
 metacharacters in (1) the collection.domain in the webdav module or (2) the
 formula field in the price_list module.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [8.8 HIGH]

Patches_tryton-server:
upstream_tryton-server: released (3.2.3-1)
lucid_tryton-server: ignored (reached end-of-life)
precise_tryton-server: ignored (reached end-of-life)
precise/esm_tryton-server: DNE (precise was needed)
trusty_tryton-server: ignored (reached end-of-life)
trusty/esm_tryton-server: DNE (trusty was needed)
utopic_tryton-server: ignored (reached end-of-life)
vivid_tryton-server: ignored (reached end-of-life)
vivid/stable-phone-overlay_tryton-server: DNE
vivid/ubuntu-core_tryton-server: DNE
wily_tryton-server: ignored (reached end-of-life)
xenial_tryton-server: not-affected (3.2.3-1)
yakkety_tryton-server: ignored (reached end-of-life)
zesty_tryton-server: ignored (reached end-of-life)
artful_tryton-server: ignored (reached end-of-life)
bionic_tryton-server: not-affected (3.2.3-1)
cosmic_tryton-server: not-affected (3.2.3-1)
disco_tryton-server: not-affected (3.2.3-1)
devel_tryton-server: not-affected (3.2.3-1)