CVE-2024-54676

Description

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Reserved 2024-12-05 | Published 2025-01-08 | Updated 2025-01-08 | Assigner apache

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status
unaffected

2.1 before 8.0.0
affected

Credits

m0d9 from Tencent Yunding Lab reporter

References

lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95 vendor-advisory

cve.org (CVE-2024-54676)

nvd.nist.gov (CVE-2024-54676)

Download JSON