{"action":"closed","issue":{"url":"https://api.github.com/repos/odoo/odoo/issues/13175","repository_url":"https://api.github.com/repos/odoo/odoo","labels_url":"https://api.github.com/repos/odoo/odoo/issues/13175/labels{/name}","comments_url":"https://api.github.com/repos/odoo/odoo/issues/13175/comments","events_url":"https://api.github.com/repos/odoo/odoo/issues/13175/events","html_url":"https://github.com/odoo/odoo/issues/13175","id":171615792,"number":13175,"title":"[SEC] 2016-04a-password-export - User access to secure password hashes","user":{"login":"odony","id":2039870,"avatar_url":"https://avatars.githubusercontent.com/u/2039870?v=3","gravatar_id":"","url":"https://api.github.com/users/odony","html_url":"https://github.com/odony","followers_url":"https://api.github.com/users/odony/followers","following_url":"https://api.github.com/users/odony/following{/other_user}","gists_url":"https://api.github.com/users/odony/gists{/gist_id}","starred_url":"https://api.github.com/users/odony/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/odony/subscriptions","organizations_url":"https://api.github.com/users/odony/orgs","repos_url":"https://api.github.com/users/odony/repos","events_url":"https://api.github.com/users/odony/events{/privacy}","received_events_url":"https://api.github.com/users/odony/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/odoo/odoo/labels/Security","name":"Security","color":"fbca04"}],"state":"closed","locked":true,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-17T09:41:33Z","updated_at":"2016-08-17T09:41:47Z","closed_at":"2016-08-17T09:41:47Z","body":"# Security Advisory (2016-04a-password-export)\r\n\r\n### User access to secure password hashes\r\n\r\n**Affects**: Odoo 8.0 and Odoo 9.0\r\n**Component**: Odoo Core (base module)\r\n**Credits**: `<Undisclosed>`\r\n\r\n## I.   Background\r\n\r\nAs of Odoo 8.0, when local passwords are used, the passwords are stored\r\nby default as salted cryptographic hashes (derived via PBKDF2 using\r\nSHA-512 hashing).\r\n\r\nIn order to protect the cryptographic hashes from being accessed by\r\nusers, a special security rule prevents reading the fields where the\r\npassword hashes are stored.\r\n\r\n## II.  Problem Description\r\n\r\nA programming error made this special security rule ineffective when\r\nthe CSV/Excel export mechanism is used.\r\n\r\n## III. Impact\r\n\r\nAccess Vector: Network exploitable\r\nAccess Complexity: Low\r\nAuthentication: \"Employee\" access required\r\nCVSS3: 4.0 ([AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C))\r\n\r\nBy using the CSV export functionality, users with \"Employee\" access\r\nmight export the password hashes of other database users, including\r\nthose of privileged users.\r\n\r\nExploiting these password hashes to retrieve user passwords is difficult\r\nbut not necessarily impossible, for example in the presence of weak\r\npasswords or passwords that may be subject to dictionary attacks.\r\n\r\nOdoo S.A. is not aware of any malicious use of this vulnerability.\r\n\r\n## IV.  Workaround\r\n\r\nNo workaround is available, but users that are exclusively authenticated\r\nvia remote LDAP credentials (auth_ldap) are not vulnerable, as they have\r\nno local password.\r\n\r\nOdoo Online servers have been patched as soon as the correction was\r\navailable.\r\n\r\n## V.   Solution\r\n\r\nApply the patches corresponding to your Odoo installation, or upgrade\r\nto the latest revision, either via GitHub or by downloading the\r\nlatest version from https://www.odoo.com/page/download\r\nor http://nightly.odoo.com\r\n\r\nTo apply the patch, change into the main directory of your Odoo\r\ninstallation (the one containing \"openerp\" and \"addons\" directories),\r\nthen execute the patch command, typically:\r\n\r\n       patch -p0 -f < /path/to/the_patch_file.patch\r\n       \r\nThis command assumes your installation layout corresponds to\r\nthe latest source code layout of the Odoo project on GitHub.\r\nIf your installation differs, please extract the various hunks\r\nfrom the patch files and apply them in the appropriate locations.\r\n\r\n## VI.  Correction details\r\n\r\nThe following list contains the revisions after which the vulnerability\r\nis corrected:\r\n\r\n- 8.0: rev. 08b7e5ab6333d4846c838cc495e75fa2b15dee5c\r\n- 9.0: rev. 2c13c1ff053da442f2d12eb450623430b17b6bff\r\n- 9.0-ent (Enterprise): see 9.0."}}
{"actor":{"display_login":"odony"}}