logo_clicknbuy.png

CVE-2024-54676 – Apache OpenMeetings Object Deserialization Vulnerability

The following table lists the changes that have been made to the
CVE-2024-54676 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Jan. 08, 2025

    Action Type Old Value New Value
    Added Description Vendor: The Apache Software Foundation

    Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0

    Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn’t specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.
    Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant ‘openjpa.serialization.class.blacklist’ and ‘openjpa.serialization.class.whitelist’ configurations as shown in the documentation.
    Added CWE CWE-502
    Added Reference https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95
  • CVE Modified
    by af854a3a-2127-422b-91ae-364da2661108

    Jan. 08, 2025

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2025/01/08/1
Share the Post:

Related Posts