CVE-2024-54676

Description

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

PUBLISHED Reserved 2024-12-05 | Published 2025-01-08 | Updated 2025-01-08 | Assigner apache

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Credits

m0d9 from Tencent Yunding Lab reporter

References

www.openwall.com/lists/oss-security/2025/01/08/1

lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95 vendor-advisory

cve.org (CVE-2024-54676)

nvd.nist.gov (CVE-2024-54676)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.