id: PYSEC-2018-59
details: The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14,
  2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated
  users to execute arbitrary commands via shell metacharacters in (1) the collection.domain
  in the webdav module or (2) the formula field in the price_list module.
affected:
- package:
    name: trytond
    ecosystem: PyPI
    purl: pkg:pypi/trytond
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 2.4.0
    - fixed: 2.4.15
    - introduced: 2.6.0
    - fixed: 2.6.14
    - introduced: 2.8.0
    - fixed: 2.8.11
    - introduced: 3.0.0
    - fixed: 3.0.7
    - introduced: 3.2.0
    - fixed: 3.2.3
  versions:
  - 2.4.0
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.12
  - 2.4.13
  - 2.4.14
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 2.6.0
  - 2.6.1
  - 2.6.10
  - 2.6.11
  - 2.6.12
  - 2.6.13
  - 2.6.2
  - 2.6.3
  - 2.6.4
  - 2.6.5
  - 2.6.6
  - 2.6.7
  - 2.6.8
  - 2.6.9
  - 2.8.0
  - 2.8.1
  - 2.8.10
  - 2.8.2
  - 2.8.3
  - 2.8.4
  - 2.8.5
  - 2.8.6
  - 2.8.7
  - 2.8.8
  - 2.8.9
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.2.0
  - 3.2.1
  - 3.2.2
references:
- type: WEB
  url: https://bugs.tryton.org/issue4155
- type: WEB
  url: http://www.tryton.org/posts/security-release-for-issue4155.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-m9jj-5qvj-5fhx
aliases:
- CVE-2014-6633
- GHSA-m9jj-5qvj-5fhx
modified: "2021-10-12T02:55:35.904690Z"
published: "2018-04-12T15:29:00Z"