Hi,
Thanks for your work on Tryton. Can you precise a little bit the context
here, do you plan a bookworm update?
On 17/09/2026 12:14, Mathias Behrle wrote:
several security issues were found and are fixed in unstable, forky and trixie.
1)
tryton-server:
https://discuss.tryton.org/t/security-release-for-issue-14947/9302
Forbid weasyprint to access local files
https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/08_restrict_weasyprint_protocol.patch?ref_type=heads
The patch is applicable on tryton-server in bookworm, but requires
'weasyprint >= 68.0' while bookworm has 57.2-1.
Is there a CVE (or TEMP) for this?
Also the referenced https://bugs.tryton.org/14947 is now 404.
So I lack the full context, but various theoretical solutions exists:
- patching weasyprint to provide the required feature,
- bumping weasyprint as it seems to only have reverse-recommends from
tryton packages and is apparently unused by other packages in bookworm
2)
https://security-tracker.debian.org/tracker/TEMP-0000000-9D9504
Python code execution via uploaded templates
https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869/9266/3
https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/06_restrict_genshi_evaluation.patch?ref_type=heads
The patch to restrict genshi evaluation applies, but there is a caveat: custom
reports could fail, if they use the forbidden functions.
This could be added to the DLA text and/or to a NEWS file to warn users.
This patch could be deployed.
https://discuss.tryton.org/t/security-release-for-issue-14907/9267/1
https://salsa.debian.org/tryton-team/tryton-server/-/blob/debian-trixie/debian/patches/07_enforce_access_right_on_email_template_records.patch?ref_type=heads
The changes made by those patches are rather intrusive, so this patch could not
be deployed IMO.
I assume this is a second fix for TEMP-0000000-9D9504.
In some cases there are more risks in applying a complex patch, than to
leave the issue unfixed. AFAIU this allows a registered Tryton user to
take over its server, which sounds severe, so hopefully an alternate fix
or a mitigation can be proposed to users.
Cheers!
Sylvain Beucler
Debian LTS Team
