Repository: openmeetings Updated Branches: refs/heads/4.0.x c384a4a0e -> f95b6321d
no jira: security page is updated with CVE-2017-5878 details Project: http://git-wip-us.apache.org/repos/asf/openmeetings/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings/commit/f95b6321 Tree: http://git-wip-us.apache.org/repos/asf/openmeetings/tree/f95b6321 Diff: http://git-wip-us.apache.org/repos/asf/openmeetings/diff/f95b6321 Branch: refs/heads/4.0.x Commit: f95b6321d7dc5dd14cfb48871b16fc80c858e25a Parents: c384a4a Author: Maxim Solodovnik <[email protected]> Authored: Thu Jan 11 17:10:06 2018 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Thu Jan 11 17:10:06 2018 +0700 ---------------------------------------------------------------------- openmeetings-server/src/site/xdoc/security.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings/blob/f95b6321/openmeetings-server/src/site/xdoc/security.xml ---------------------------------------------------------------------- diff --git a/openmeetings-server/src/site/xdoc/security.xml b/openmeetings-server/src/site/xdoc/security.xml index be1d7f3..cc09e75 100644 --- a/openmeetings-server/src/site/xdoc/security.xml +++ b/openmeetings-server/src/site/xdoc/security.xml @@ -173,6 +173,19 @@ All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> <p>Credit: This issue was identified by Security Innovation</p> </section> + <section name="CVE-2017-5878 - RED5/AMF Unmarshalling RCE"> + <p>Severity: Critical</p> + <p>Vendor: Red5</p> + <p>Versions Affected: Apache OpenMeetings 3.1.3 and earlier</p> + <p>Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the + classes for which it performs deserialization, which allows remote attackers to execute + arbitrary code via crafted serialized Java data.<br/> + <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5878";>CVE-2017-5878</a> + </p> + <p>The issue was fixed in 3.1.4<br/> + All users are recommended to upgrade to Apache OpenMeetings 3.1.4</p> + <p>Credit: This issue was identified by Moritz Bechler</p> + </section> <section name="CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE"> <p>Severity: Moderate</p> <p>Vendor: The Apache Software Foundation</p>
