id: PYSEC-2013-28
details: Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed
  before 20131104 and earlier, allows remote servers to write arbitrary files via
  path separators in the extension of a report.
affected:
- package:
    name: tryton
    ecosystem: PyPI
    purl: pkg:pypi/tryton
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.0.1
  versions:
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - 1.8.0
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - 1.8.5
  - 1.8.6
  - 1.8.7
  - 1.8.8
  - 1.8.9
  - 2.0.0
  - 2.0.1
  - 2.0.10
  - 2.0.11
  - 2.0.12
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.0.8
  - 2.0.9
  - 2.2.0
  - 2.2.1
  - 2.2.10
  - 2.2.11
  - 2.2.12
  - 2.2.13
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.4.0
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.12
  - 2.4.13
  - 2.4.14
  - 2.4.15
  - 2.4.16
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 2.6.0
  - 2.6.1
  - 2.6.10
  - 2.6.11
  - 2.6.12
  - 2.6.13
  - 2.6.14
  - 2.6.15
  - 2.6.16
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.8.0
  - 2.8.1
  - 2.8.10
  - 2.8.11
  - 2.8.12
  - 2.8.13
  - 2.8.14
  - 2.8.15
  - 2.8.16
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.8.6
  - 2.8.7
  - 2.8.8
  - 2.8.9
  - 3.0.0
references:
- type: WEB
  url: http://hg.tryton.org/tryton/rev/357d0a4d9cb8
- type: WEB
  url: http://www.tryton.org/posts/security-release-for-issue3446.html
- type: ADVISORY
  url: http://www.debian.org/security/2013/dsa-2791
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/11/04/21
- type: WEB
  url: https://bugs.tryton.org/issue3446
aliases:
- CVE-2013-4510
modified: "2021-07-25T23:34:56.639990Z"
published: "2013-11-18T02:55:00Z"