[Bug 1131707] VUL-1: CVE-2019-10868: In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no

http://bugzilla.suse.com/show_bug.cgi?id=1131707 http://bugzilla.suse.com/show_bug.cgi?id=1131707#c2 Axel Braun <axel.braun@gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #2 from Axel Braun <axel.braun@gmx.de> --- (In reply to Alexandros Toptsoglou from comment #1)

TW --> 4.6.16 not affected

TW *is* affected as well! will wai for gnuhealth-client (affected as well...) and update all together -- You are receiving this mail because: You are on the CC list for the bug.