~ / search / GHSA-mjf9-4pcv-vfg7

GHSA-mjf9-4pcv-vfg7

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-54676

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.openmeetings:openmeetings-parent >= 2.1.0, < 8.0.0 8.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

References

External links from the advisory. They lead to third-party sites.