GitHub Advisoryadvisory · Maven

GHSA-mjf9-4pcv-vfg7 Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

CRITICAL Published 2025-01-08 Modified 2025-01-08 Official page ↗
Aliases
CVE-2024-54676
Ecosystem
Maven
Packages
org.apache.openmeetings:openmeetings-parent
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-502
Reviewed
2025-01-08

Affected packages

• Maven org.apache.openmeetings:openmeetings-parent: >= 2.1.0, < 8.0.0 → fixed in 8.0.0

Description

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Related

Alias · CVE (1)

  • CVE-2024-54676 Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References