CVE-2017-10804: Critical severity odoo vulnerability

Published Jul 4, 2017

Updated

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before 2.6.3 is used.

Affected Software

5 affected components

Odoo=8.0

Odoo=9.0

Odoo=10.0

Remediation

Patch Available

https://github.com/odoo/odoo/issues/17914

Event History

Jul 4, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-10804?

CVE-2017-10804 is classified as a medium severity vulnerability due to the potential for authentication bypass.

How do I fix CVE-2017-10804?

To fix CVE-2017-10804, it is recommended to update to a patched version of Odoo that addresses this authentication bypass issue.

Which versions of Odoo are affected by CVE-2017-10804?

CVE-2017-10804 affects Odoo versions 8.0, 9.0, and 10.0 for both Community and Enterprise Editions.

Can attackers exploit CVE-2017-10804 remotely?

Yes, remote attackers may exploit CVE-2017-10804 to bypass authentication under specific conditions.

What causes the vulnerability in CVE-2017-10804?

CVE-2017-10804 is caused by the truncation of parameters containing 0x00 characters before they reach the database layer.