Stay Secure with the Latest Linux Advisories

security advisorydebiancritical threat

Debian LTS DLA-4054-1 critical: Tryton Client zip bomb threat

Cédric Krier has found that trytond, the Tryton application server, accepts compressed content from unauthenticated requests which makes it vulnerable to zip bomb attacks (see DLA 4022-1). . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4054-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Daniel Leidert February 16, 2025 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : tryton-client Version : 5.0.33-1+deb11u1 CVE ID : not yet available Debian Bug : none Cédric Krier has found that trytond, the Tryton application server, accepts compressed content from unauthenticated requests which makes it vulnerable to zip bomb attacks (see DLA 4022-1). This update fixes a potential regression in tryton-client. It allows users only to send gzip content within a session. For Debian 11 bullseye, this problem has been fixed in version 5.0.33-1+deb11u1. We recommend that you upgrade your tryton-client packages. For the detailed security status of tryton-client please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/tryton-client Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Advisory DLA-4060-1 warns of potential vulnerabilities in the zip tool and recommends upgrading the zip package.. Debian Security, Tryton Client, Zip Bomb Fix, Client Update, LTS Advisory. . Severity: Critical. LinuxSecurity.com Team

Feb 16, 2025 •Critical Debian LTS