-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 02 Sep 2026 15:11:59 +0200 Source: tryton-server Binary: tryton-server tryton-server-all-in-one tryton-server-doc tryton-server-nginx tryton-server-postgresql tryton-server-uwsgi Architecture: all Version: 7.0.30-1+deb13u2 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Mathias Behrle Description: tryton-server - Tryton application platform - server tryton-server-all-in-one - Tryton application platform - full installation tryton-server-doc - Tryton application platform - server documentation tryton-server-nginx - Tryton application platform - Nginx integration tryton-server-postgresql - Tryton application platform - PostgreSQL integration tryton-server-uwsgi - Tryton application platform - uWSGI integration Changes: tryton-server (7.0.30-1+deb13u2) trixie-security; urgency=high . * Add 06_restrict_genshi_evaluation.patch. From https://discuss.tryton.org/t/security-release-for-issue-5160-and-14869: Security Release for issue #5160 and #14869 The user titou has discovered that the administrator group can execute Python code on the server which is hidden inside an uploaded report template. And Dan Shallom has discovered that the same can also be accomplished by the marketing group when uploading marketing email templates. This patch also contains the subsequent fixes from https://bugs.tryton.org/14928, https://bugs.tryton.org/14932 * Add 07_enforce_access_right_on_email_template_records.patch. From https://discuss.tryton.org/t/security-release-for-issue-14907: Cédric Krier has discovered that access is not enforced when browsing record instances in templates. This patch also contains the required patch adding ModelAccessProxy https://foss.heptapod.net/tryton/tryton/-/merge_requests/3431 * Add 08_restrict_weasyprint_protocol.patch. From https://discuss.tryton.org/t/security-release-for-issue-14947: Cédric Krier has discovered that Tryton does not prevent weasyprint to access local files when rendering HTML report to PDF. https://foss.heptapod.net/tryton/tryton/-/work_items/14947 The weasyprint documentation states that it can be used to access local files. Checksums-Sha1: 04c464d8b6fe76ca7160337b85a667955380818e 26912 tryton-server-all-in-one_7.0.30-1+deb13u2_all.deb 8736f096ef54ae7cc65b25a1b0d5f3830c6108e5 239884 tryton-server-doc_7.0.30-1+deb13u2_all.deb 3dae06c6c50a0f1e0ad948062ac8df9a5c72ef4b 30264 tryton-server-nginx_7.0.30-1+deb13u2_all.deb 64355f7e138f586781ab1ef2e29c14f9214719a2 27460 tryton-server-postgresql_7.0.30-1+deb13u2_all.deb 3edb3524ad06b0d9b9e3cd2b7df9491d688d2050 28396 tryton-server-uwsgi_7.0.30-1+deb13u2_all.deb c4a53719cbef576dae335f9a972fa95519107c43 10398 tryton-server_7.0.30-1+deb13u2_all-buildd.buildinfo d4c804a971db932b82976d7f013eeba447d86b6c 576192 tryton-server_7.0.30-1+deb13u2_all.deb Checksums-Sha256: fc721457c58317a68eb104956491b2145e124812626d64be16e9125908ca3778 26912 tryton-server-all-in-one_7.0.30-1+deb13u2_all.deb 83410bdf0c1d1afdb7dcbb8e1e563e4108448cd18b3155b225fe1930baa00181 239884 tryton-server-doc_7.0.30-1+deb13u2_all.deb f11a702ab8f0c8c57db1607a3f42ecc42e10ebd6256f28ea9b7b8e9d580400a9 30264 tryton-server-nginx_7.0.30-1+deb13u2_all.deb 0b6f4a1308f8c250be9b02b34b7a88667a28e24457dab0076ef25fea60268d68 27460 tryton-server-postgresql_7.0.30-1+deb13u2_all.deb 283adec6a2e96762d0b997fcf7e3a4841648ffcbb00674647c73e7b4df2ee52c 28396 tryton-server-uwsgi_7.0.30-1+deb13u2_all.deb f09b88345cefe7616b8e33b210295b9304efddc4e82ca93d301245bd8fffef95 10398 tryton-server_7.0.30-1+deb13u2_all-buildd.buildinfo 8e604b72b9c4c9673a93e511933aed2031dcdd3dfa82dbc82f998824378204d9 576192 tryton-server_7.0.30-1+deb13u2_all.deb Files: 42dcf9313209e92e51e9c75bc4736433 26912 python optional tryton-server-all-in-one_7.0.30-1+deb13u2_all.deb 6a28c0a9c7bd5358c8add536a93e9f10 239884 doc optional tryton-server-doc_7.0.30-1+deb13u2_all.deb e37d6da2a8cb254f1a543f8438176a3c 30264 python optional tryton-server-nginx_7.0.30-1+deb13u2_all.deb 2fc33cfb310fbcff79804378ae80482a 27460 python optional tryton-server-postgresql_7.0.30-1+deb13u2_all.deb 0021c1a2e65750532021de64b2c7c07d 28396 python optional tryton-server-uwsgi_7.0.30-1+deb13u2_all.deb 8f915d66e681c0eb9d435d658aa73675 10398 python optional tryton-server_7.0.30-1+deb13u2_all-buildd.buildinfo ee4015eb5fb43ba9859c17796a73cd7c 576192 python optional tryton-server_7.0.30-1+deb13u2_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmqa3o0ACgkQmgPNRvTf /zdP1g/+JR1vije5DnOhOnyPqRZiYdXALl0RI/BKoDfOlNf/7+bv9/7OpPO2rTO8 cq4znYxJeAeKlZR+/63pb3Zc09tWguKUxn0p6sEeNWvOzXeQL36EgDoBtQe63qlL l36LaGyGiCwtjikABUtVOm4xnJzvCqO2fqLTyUqFXSHV4laXekmHKiuwwAJ2tyWu Zp2d8ntlH+BdZpSPNpE5Hkq/nwB9wHPV3Q6fftKJBSwAH8vF8jK3+LpdhDQn3vWA EAaFa3lcGqI6l4SrsecZtEocoPyr6oc/rWM+JvADr7b3cDy6tzI9Muuaa1ZAxGkY QqhJJZWiuCFmNsGQ5is5O+ZzWYvQwshIghH5FT5ZTaMIQPKj7OY+3GjC4044FBun 5m04QNdmPj7+AdQ0I3SKBZ6IGU+LleqIAsCp6dkF+ntpZR56x6gj11uqctdUwB1o LS3IRR4Ijhxq1fv8LTfyMn9Wyu7JSwZ83gjZjpOypdgJvmUmrZtAVS2UpRJqu1PN nrcjUVpirUNhqblK+jZzaTK/BwMd6dZX8RjEY2AZ5EcEc6mrXC8I7Y4b5/YcDfmY LvGL7eBVxymzhCMy+ztkk5BdBW69DhJUr8turfsOnaoF4kvgpcjjaXg7t8P5y3I+ eqiF1LQWC5PMO5+JSs6Jg15xo9mvG+gmtXCgbb0pPy/iboyFyK0= =U7um -----END PGP SIGNATURE-----