Information disclosure in Tryton - CVE-2016-1241

Vulnerability identifier: #VU40130

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-1241

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to gain access to sensitive information.

Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.

Tryton
Fedora
python-proteus
trytond-account-invoice
trytond-account-product
trytond-account-statement
trytond-google-maps
trytond-party
trytond-account
trytond-company
trytond-purchase
trytond-sale
trytond-stock
tryton
trytond

Install update from vendor's website.

python-proteus - update to 4.0.2-1.fc25
trytond-account-invoice - update to 4.0.2-1.fc25
trytond-account-product - update to 4.0.2-1.fc25
trytond-account-statement - update to 4.0.2-1.fc25
trytond-google-maps - update to 4.0.2-1.fc25
trytond-party - update to 4.0.2-1.fc25
trytond-account - update to 4.0.3-1.fc25
trytond-company - update to 4.0.3-1.fc25
trytond-purchase - update to 4.0.3-1.fc25
trytond-sale - update to 4.0.3-1.fc25
trytond-stock - update to 4.0.3-1.fc25
tryton - update to 4.0.4-1.fc25
trytond - update to 4.0.4-1.fc25

• http://www.debian.org/security/2016/dsa-3656
• http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html
• https://bugs.tryton.org/issue5795

• Multiple vulnerabilities in Python Tryton
• Fedora 25 update for python-proteus, tryton, trytond, trytond-account, trytond-account-invoice, trytond-account-product, trytond-account-statement, trytond-company, trytond-google-maps, trytond-party, trytond-purchase, trytond-sale, trytond-stock