Repository: openmeetings-site Updated Branches: refs/heads/asf-site 9d825445d -> 097b7f195
no jira: security page is updated with CVE-2017-5878 details Project: http://git-wip-us.apache.org/repos/asf/openmeetings-site/repo Commit: http://git-wip-us.apache.org/repos/asf/openmeetings-site/commit/097b7f19 Tree: http://git-wip-us.apache.org/repos/asf/openmeetings-site/tree/097b7f19 Diff: http://git-wip-us.apache.org/repos/asf/openmeetings-site/diff/097b7f19 Branch: refs/heads/asf-site Commit: 097b7f19573c64e2bbebae4690a744b7f63812ba Parents: 9d82544 Author: Maxim Solodovnik <[email protected]> Authored: Thu Jan 11 17:16:57 2018 +0700 Committer: Maxim Solodovnik <[email protected]> Committed: Thu Jan 11 17:16:57 2018 +0700 ---------------------------------------------------------------------- security.html | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/openmeetings-site/blob/097b7f19/security.html ---------------------------------------------------------------------- diff --git a/security.html b/security.html index 8b69a23..831c801 100644 --- a/security.html +++ b/security.html @@ -218,7 +218,7 @@ <div> <ol class="breadcrumb"> <li class="publishDate version-date"> - Last Published: 2017-12-06 + Last Published: 2018-01-11 </li> </ol> </div> @@ -338,7 +338,16 @@ <p>Credit: This issue was identified by Security Innovation</p> </div> <div class="section"> - <h2 id="CVE-2016-8736_-_Apache_Openmeetings_RMI_Registry_Java_Deserialization_RCE">CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE</h2> + <h2 id="_toc_cve-2017-5878_-_red5amf_unmarshalling_rce">CVE-2017-5878 - RED5/AMF Unmarshalling RCE</h2> + <p>Severity: Critical</p> + <p>Vendor: Red5</p> + <p>Versions Affected: Apache OpenMeetings 3.1.3 and earlier</p> + <p>Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5878";>CVE-2017-5878</a> </p> + <p>The issue was fixed in 3.1.4<br> All users are recommended to upgrade to Apache OpenMeetings 3.1.4</p> + <p>Credit: This issue was identified by Moritz Bechler</p> +</div> +<div class="section"> + <h2 id="_toc_cve-2016-8736_-_apache_openmeetings_rmi_registry_j">CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE</h2> <p>Severity: Moderate</p> <p>Vendor: The Apache Software Foundation</p> <p>Versions Affected: Apache OpenMeetings 3.1.0</p> @@ -412,7 +421,16 @@ <li><a href="#CVE-2017-7684_-_Apache_OpenMeetings_-_Insecure_File_Upload" title="CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload">CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload</a> <li><a href="#CVE-2017-7685_-_Apache_OpenMeetings_-_Insecure_HTTP_Methods" title="CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods">CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods</a> <li><a href="#CVE-2017-7688_-_Apache_OpenMeetings_-_Insecure_Password_Update" title="CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update">CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update</a> - <li><a href="#CVE-2016-8736_-_Apache_Openmeetings_RMI_Registry_Java_Deserialization_RCE" title="CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE">CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE</a> + <li> + <a href="#_toc_cve-2017-5878_-_red5amf_unmarshalling_rce" title="CVE-2017-5878 - RED5/AMF Unmarshalling RCE"> +<span class="fa fa-angle-double-right"></span> CVE-2017-5878 - RED5/AMF Unmarshalling RCE + </a> +</li> + <li> + <a href="#_toc_cve-2016-8736_-_apache_openmeetings_rmi_registry_j" title="CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE"> +<span class="fa fa-angle-double-right"></span> CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE + </a> +</li> <li><a href="#CVE-2016-3089_-_Apache_OpenMeetings_XSS_in_SWF_panel" title="CVE-2016-3089 - Apache OpenMeetings XSS in SWF panel">CVE-2016-3089 - Apache OpenMeetings XSS in SWF panel</a> <li><a href="#CVE-2016-0783_-_Predictable_password_reset_token" title="CVE-2016-0783 - Predictable password reset token">CVE-2016-0783 - Predictable password reset token</a> <li><a href="#CVE-2016-0784_-_ZIP_file_path_traversal" title="CVE-2016-0784 - ZIP file path traversal">CVE-2016-0784 - ZIP file path traversal</a>
