full-disclosure - [FD] SSD Advisory

Open Source and information security mailing list archives

Date: Sun, 2 Jul 2017 08:47:58 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Cc: SecuriTeam Secure Disclosure <ssd@...ondsecurity.com>
Subject: [FD] SSD Advisory – Odoo CRM Code Execution

Hi,

Link: https://blogs.securiteam.com/index.php/archives/3246
Twitter: @SecuriTeam_SSD

Vulnerability Summary
The following advisory describe arbitrary Python code execution found in
Odoo CRM version 10.0

Odoo is a suite of open source business apps that cover all your company
needs: CRM, eCommerce, accounting, inventory, point of sale, project
management, etc. Odoo’s unique value proposition is to be at the same time
very easy to use and fully integrated.

Credit
An independent security researcher has reported this vulnerability to
Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
Odoo has done a private disclosure for the issue we reported, and the patch
was merged in all supported branches.

The full public disclosure will be available at
https://github.com/odoo/odoo/issues/17898.

The full write-up is attached

--
Thanks
Maor Shwartz
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – Odoo CRM Code Execution – SecuriTeam Blogs.pdf" of type "application/pdf" (81199 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives