Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tamY5LTRwY3YtdmZnN84ABDF5

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0

Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.
Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Permalink: https://github.com/advisories/GHSA-mjf9-4pcv-vfg7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tamY5LTRwY3YtdmZnN84ABDF5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 21 days ago
Updated: 21 days ago

EPSS Percentage: 0.00177
EPSS Percentile: 0.55325

Identifiers: GHSA-mjf9-4pcv-vfg7, CVE-2024-54676
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-54676
• https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95
• http://www.openwall.com/lists/oss-security/2025/01/08/1
• https://github.com/apache/openmeetings/commit/1c3426c6d3abbd984a3c01a61decf1242ea38923
• https://issues.apache.org/jira/browse/OPENMEETINGS-2787
• https://github.com/advisories/GHSA-mjf9-4pcv-vfg7

Repository: https://github.com/apache/openmeetings
Blast Radius: 0.0

Affected Packages