From 019567fad83094b4e5b983cb1c657272d39a76da Mon Sep 17 00:00:00 2001 From: Janik von Rotz Date: Mon, 30 Dec 2024 16:39:58 +0100 Subject: [PATCH] vault backup: 2024-12-30 16:39:58 --- CVE.md | 2 +- ... Security Advisory - ODOO-SA-2024-12-23.md | 67 +++++++++++++++++++ Odoo Security Advisory.md | 25 +++++++ Odoo Security.md | 6 +- ...sse Sicherheit - Odoo Security Advisory.md | 12 ++++ Prozesse Sicherheit.md | 3 +- Security.md | 7 +- 7 files changed, 116 insertions(+), 6 deletions(-) create mode 100644 Odoo Security Advisory - ODOO-SA-2024-12-23.md create mode 100644 Odoo Security Advisory.md create mode 100644 Prozesse Sicherheit - Odoo Security Advisory.md diff --git a/CVE.md b/CVE.md index 8d1ba5bd..5c7b512a 100644 --- a/CVE.md +++ b/CVE.md @@ -4,7 +4,7 @@ tags: --- # CVE -Common Vulnerabilities and Exposures +Common Vulnerabilities and Exposures. ## List diff --git a/Odoo Security Advisory - ODOO-SA-2024-12-23.md b/Odoo Security Advisory - ODOO-SA-2024-12-23.md new file mode 100644 index 00000000..3b6224c2 --- /dev/null +++ b/Odoo Security Advisory - ODOO-SA-2024-12-23.md @@ -0,0 +1,67 @@ +# Odoo Security Advisory - ODOO-SA-2024-12-23 + +## [CVE-2024-12368](https://www.odoo.com/security-advisories/CVE-2024-12368.txt) + +Affects: Odoo 15.0 (Community and Enterprise Editions) +Severity :: High :: 8.1 :: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N +Databases with OAuth enabled are vulnerable to session hijacking by malicious +internal users, limited to the users who are actually authenticated via OAuth. +This exploit is only possible within the brief window of the OAuth token's +validity, which is controlled by the OAuth provider. During this window +a user could hijack the session of a more privileged user, resulting in a +privilege escalation. + +## [CVE-2024-36259](https://www.odoo.com/security-advisories/CVE-2024-36259.txt) + +Affects: Odoo 17.0 (Community and Enterprise Editions) +Severity :: High :: 7.5 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N +Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise +17.0 allows remote authenticated attackers to extract sensitive information via +an oracle-based (yes/no response) crafted attack. + +## [CVE-2024-45840](https://www.odoo.com/security-advisories/CVE-2024-45840.txt) + +Affects: Odoo 15.0 and earlier (Community and Enterprise Editions) +Severity :: Medium :: 5.8 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N +Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise +15.0 and earlier allows remote authenticated users to download arbitrary server- +side source code files. + +## [CVE-2024-45681](https://www.odoo.com/security-advisories/CVE-2024-45681.txt) + +Affects: Odoo 17.0 and earlier (Community and Enterprise Editions) +Severity :: Critical :: 9.1 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N +Improper input validation in Odoo Community 17.0 and earlier and Odoo +Enterprise version 17.0 and earlier may allow remote authenticated attackers to +create arbitrary records via crafted RPC requests. + +## [CVE-2024-36490](https://www.odoo.com/security-advisories/CVE-2024-36490.txt) + +Affects: Odoo 16.0 (Community and Enterprise Editions) +Severity :: High :: 8.1 :: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N +Improper access control in the mail template edition of Odoo Community 16.0 and +Odoo Enterprise 16.0 allows internal users to escalate privileges. + +## [CVE-2024-12865](https://www.odoo.com/security-advisories/CVE-2024-12865.txt) + +Affects: Odoo 15.0 through 16.0 (Community and Enterprise Editions) +Severity :: Medium :: 5.9 :: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N +Improper access control in Project App of Odoo Community 15.0 through 16.0 +and Odoo Enterprise 15.0 through 16.0 allows a portal user to alter the email +address of other users. + +## [CVE-2024-12887](https://www.odoo.com/security-advisories/CVE-2024-12887.txt) + +Affects: Odoo 16.0 and later (Community and Enterprise Editions) +Severity :: Medium :: 5.3 :: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N +Improper origin validation for WebSocket requests in Odoo Community 16.0 and +later and Odoo Enterprise version 16.0 and later allows WebSocket cross-origin +requests. + +## [CVE-2024-49575](https://www.odoo.com/security-advisories/CVE-2024-49575.txt) + +Affects: Odoo 16.0 and earlier (Community and Enterprise Editions) +Severity :: Critical :: 9.1 :: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N +Improper input validation in OAuth module of Odoo Community 16.0 and earlier +and Odoo Enterprise 16.0 and earlier allows an attacker authenticated via OAuth +to escalate privileges by sending crafted HTTP requests. diff --git a/Odoo Security Advisory.md b/Odoo Security Advisory.md new file mode 100644 index 00000000..39cdad2b --- /dev/null +++ b/Odoo Security Advisory.md @@ -0,0 +1,25 @@ +--- +lang: en +--- +# Odoo Security Advisory + +Responsible disclosure policy for Odoo security vulnerabilities. + +Website: + +The policy describes how security researcher can submit their findings and tells what the incident response procedure looks like. + +Valid vulnerabilities receive a CVE (Common Vulnerabilities and Exposures) ID. + +## Public Channels + +CVEs are published on GitHub as issues: . + +## Notifications + +Odoo notifies Odoo Enterprise customers with an on-premise installation of Odoo. + +Here are CVEs addressed by mail from Odoo: + +* [[Odoo Security Advisory - ODOO-SA-2024-12-23]] + diff --git a/Odoo Security.md b/Odoo Security.md index 3b56771d..a4a8ce08 100644 --- a/Odoo Security.md +++ b/Odoo Security.md @@ -7,7 +7,7 @@ tags: Odoo verwaltet besonderns schützenswerte Daten und ist zugleich über das Internet erreichbar. Das setzt besondere Anforderungen an die Security voraus. -Für die Sicherheit der Software trägt [[Odoo S.A.]] die Verantwortung: +Für die Sicherheit der Software trägt [[Odoo S.A.]] die Verantwortung: . Für das Odoo-Hosting trägt die [[Mint System GmbH]] die Verantwortung. @@ -25,4 +25,6 @@ Die Berechtigungsstrukturen in Odoo sind sehr strikt. Auch wenn ein Unbefugte Zu **Sicherheitslücken** -Die Odoo Imgebung wird regelmässig aktualisiert. Dadurch werden die grössten [[OWASP-Sicherheitslücken]] mitigiert. Eine Ausführung dazu gibt es hier: \ No newline at end of file +Die Odoo Imgebung wird regelmässig aktualisiert. Dadurch werden die grössten [[OWASP-Sicherheitslücken]] mitigiert. Eine Ausführung dazu gibt es hier: . + +Enterprise-Kunden werden über Sicherheitslücken über die [[Odoo Security Advisory]] benachrichtigt. \ No newline at end of file diff --git a/Prozesse Sicherheit - Odoo Security Advisory.md b/Prozesse Sicherheit - Odoo Security Advisory.md new file mode 100644 index 00000000..4a4bcaab --- /dev/null +++ b/Prozesse Sicherheit - Odoo Security Advisory.md @@ -0,0 +1,12 @@ +# Prozesse Sicherheit - Odoo Security Advisory + +## Odoo Security Advisory verarbeiten + +Auslöser: Odoo versende eine Mail mit einer [[Odoo Security Advisory]]. + +Arbeitsschritte: + +* Die Liste der CVEs wird unter [[Odoo Security Advisory#Notifications]] festgehalten. +* Es wird eine Liste von betroffenen Kunden erstellt. +* Für die betroffenen Odoo Versionen wird eine neue Revision erstellt. +* Das Revisions-Upgrade wird geplant. \ No newline at end of file diff --git a/Prozesse Sicherheit.md b/Prozesse Sicherheit.md index b9cf28d7..ffe7faf5 100644 --- a/Prozesse Sicherheit.md +++ b/Prozesse Sicherheit.md @@ -7,4 +7,5 @@ Dokumentation der Sicherheit-Prozesse. Verantwortlich: [[Janik von Rotz]] -* [[Prozess Sicherheit - Assessment]] \ No newline at end of file +* [[Prozess Sicherheit - Assessment]] +* [[Prozesse Sicherheit - Odoo Security Advisory]] \ No newline at end of file diff --git a/Security.md b/Security.md index 8e98f096..0f68ee35 100644 --- a/Security.md +++ b/Security.md @@ -1,10 +1,13 @@ --- tags: -- Asset + - Asset +lang: en --- # Security -Themen: +Security is a practice. It is not something that can be bought or out sourced. A good security is cumulative result of protecting an organisation and system against common threats and vulnerabilities. The playing field of attackers and defense is ever changing. There is no such thing as 100% secure. + +Topics: * [[Web Application Firewall]] * [[Zugriffskontrolle]]