Medium
tryton-client — security advisory
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
- Products
- tryton-client
- Affected versions
- 3.6.2-1, 3.6.3-1, 3.8.2-1, 3.8.3-1, 3.8.4-1, 4.4.1-2, 4.4.2-1, 4.6.0-1, 4.6.1-1, 4.6.2-1, 4.6.5-1, 5.0.12-1, 5.0.15-1, 5.0.17-1, 5.0.33-1, 6.0.10-1, 6.0.28-1, 6.0.29-1, 6.0.34-1, 6.0.8-1, 6.0.8-2, 7.0.20-1, 7.0.24-1, 7.0.27-2, 7.0.31-1, 7.0.35-1, 7.0.41-1
- Fixed versions
- Not specified
- CVEs
- CVE-2018-19443
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:27 UTC · Revision 1
Source evidence
The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
osv:UBUNTU-CVE-2018-19443
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
tryton-client
Fixed versions: Not specified
Complete source record
{
"id": "a54e3bc11debfeec2f5eed41865d03d6fdd8604815f1f42db2c9a01d25969ef4",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-19443",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2018-19443",
"summary": "The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.",
"evidence": "osv:UBUNTU-CVE-2018-19443",
"products": [
{
"name": {
"value": "tryton-client",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.6.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.6.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.8.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.8.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.8.4-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.4.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.4.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.6.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.6.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.6.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.6.5-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.15-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.17-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.33-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.0.8-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.0.8-2",
"evidence": "/affected/3/versions"
},
{
"value": "6.0.10-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.28-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.0.29-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.0.34-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.0.20-1",
"evidence": "/affected/5/versions"
},
{
"value": "7.0.24-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.0.31-1",
"evidence": "/affected/6/versions"
},
{
"value": "7.0.35-1",
"evidence": "/affected/6/versions"
},
{
"value": "7.0.41-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "tryton-client",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.0.24-1",
"evidence": "/affected/7/versions"
},
{
"value": "7.0.27-2",
"evidence": "/affected/7/versions"
},
{
"value": "7.0.31-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2018-19443",
"aliases": [
"UBUNTU-CVE-2018-19443"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"3.6.2-1",
"3.6.3-1",
"3.8.2-1",
"3.8.3-1",
"3.8.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "3.8.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"4.4.1-2",
"4.4.2-1",
"4.6.0-1",
"4.6.1-1",
"4.6.2-1",
"4.6.5-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "4.6.5-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"5.0.12-1",
"5.0.15-1",
"5.0.17-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "5.0.17-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"5.0.33-1",
"6.0.8-1",
"6.0.8-2",
"6.0.10-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "6.0.10-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"6.0.28-1",
"6.0.29-1",
"6.0.34-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "6.0.34-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"7.0.20-1",
"7.0.24-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "7.0.24-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"7.0.31-1",
"7.0.35-1",
"7.0.41-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "7.0.41-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tryton-client",
"purl": "pkg:deb/ubuntu/tryton-client?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"7.0.24-1",
"7.0.27-2",
"7.0.31-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19443.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "tryton-client",
"binary_version": "7.0.31-1"
}
]
}
}
],
"modified": "2026-10-17T12:55:23.895052217Z",
"provider": "osv",
"upstream": [
"CVE-2018-19443"
],
"references": [
"https://ubuntu.com/security/CVE-2018-19443",
"https://discuss.tryton.org/t/security-release-for-issue7792/830",
"https://bugs.tryton.org/issue7792",
"https://www.cve.org/CVERecord?id=CVE-2018-19443"
]
},
"related_cves": [
{
"value": "CVE-2018-19443",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353689,
"published_at": "2018-11-22T19:29:00+00:00"
}