Authentication Bypass in Odoo Products Due to Parameter Truncation

CVE-2017-10804

What is CVE-2017-10804?

An authentication bypass vulnerability exists in Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0. This issue arises when remote attackers manipulate parameters containing 0x00 characters, which are truncated prior to reaching the database layer. The underlying cause is the use of Psycopg 2.x prior to version 2.6.3, which leads to the improper handling of input data. This can allow malicious actors to exploit the vulnerability and potentially gain unauthorized access.

References