diff --git a/CHANGELOG.md b/CHANGELOG.md index dbd018995e..5e2e5c37f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,11 +3,42 @@ Apache OpenMeetings Change Log Licensed under Apache License 2.0 - http://www.apache.org/licenses/LICENSE-2.0 See https://issues.apache.org/jira/browse/OPENMEETINGS-* (where * is the number of the issue below) -See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-* (where * is the number of CVE below) +See https://www.cve.org/CVERecord?id=CVE-* (where * is the number of CVE below) + + +Release Notes - Openmeetings - Version 7.1.0 +================================================================================================================ + +* Vulnerability + * CVE-2023-28936: Apache OpenMeetings: insufficient check of invitation hash + * CVE-2023-29032: Apache OpenMeetings: allows bypass authentication + * CVE-2023-29246: Apache OpenMeetings: allows null-byte Injection + +* Bug + * [OPENMEETINGS-2760] - Room name overlap on menu in RTL + * [OPENMEETINGS-2763] - Turn server is not being set + * [OPENMEETINGS-2764] - Permissions are incorrectly being set + * [OPENMEETINGS-2765] - Paths should be verified in configuration + * [OPENMEETINGS-2767] - WebRTC connection is not established in FF + * [OPENMEETINGS-2768] - Save button is hidden + * [OPENMEETINGS-2769] - Ask permission confirmation pops out event when it shouldn't + +* Improvement + * [OPENMEETINGS-2761] - Missing German Translations for new OTP-dialogs + * [OPENMEETINGS-2762] - Invitation hash check should be more strict + +* Task + * [OPENMEETINGS-2757] - (7.1.0) Libraries should be updated + * [OPENMEETINGS-2758] - (7.1.0) Sonar issues need to be addressed + * [OPENMEETINGS-2759] - (7.1.0) All translations from PoEditor should be synced + Release Notes - Openmeetings - Version 7.0.0 ================================================================================================================ +* Vulnerability + * CVE-2023-28326: Apache OpenMeetings: allows user impersonation + * Bug * [OPENMEETINGS-2253] - Interruption of a video session when the microphone is turned on / off * [OPENMEETINGS-2471] - Invitation email format diff --git a/README.md b/README.md index 8ee345dcc1..9dfdeadd07 100644 --- a/README.md +++ b/README.md @@ -56,9 +56,30 @@ Release Notes see [CHANGELOG.md](/CHANGELOG.md) file for detailed log + +7.1.0 +----- +[Release 7.1.0](https://www.apache.org/dyn/closer.lua/openmeetings/7.1.0), provides following improvements: + +IMPORTANT: Java 17 and KMS 6.18.0+ are required + +Security: +* Invitation hash check made strict +* Set of user permissions is fixed +* Paths entered in Admin->Config are being verified +* All dependencies are updated with most recent versions + +Stability: +* TURN server config is passed to the client + +***3 security vulnerabilities were addressed*** + +Some other fixes and improvements, 12 issues were addressed + + 7.0.0 ----- -[Release 7.0.0](https://www.apache.org/dyn/closer.lua/openmeetings/7.0.0), provides following improvements: +[Release 7.0.0](https://archive.apache.org/dist/openmeetings/7.0.0), provides following improvements: IMPORTANT: Java 17 is required diff --git a/openmeetings-core/pom.xml b/openmeetings-core/pom.xml index 2f7f72752b..491a9b1ace 100644 --- a/openmeetings-core/pom.xml +++ b/openmeetings-core/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-core diff --git a/openmeetings-db/pom.xml b/openmeetings-db/pom.xml index c720b9980d..5599c8b15d 100644 --- a/openmeetings-db/pom.xml +++ b/openmeetings-db/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-db diff --git a/openmeetings-install/pom.xml b/openmeetings-install/pom.xml index a513435150..68d89d45b2 100644 --- a/openmeetings-install/pom.xml +++ b/openmeetings-install/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-install diff --git a/openmeetings-mediaserver/pom.xml b/openmeetings-mediaserver/pom.xml index 07acb44ed2..7913efbe59 100644 --- a/openmeetings-mediaserver/pom.xml +++ b/openmeetings-mediaserver/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-mediaserver diff --git a/openmeetings-screenshare/pom.xml b/openmeetings-screenshare/pom.xml index 88b453f3ab..343fa3e237 100644 --- a/openmeetings-screenshare/pom.xml +++ b/openmeetings-screenshare/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-screenshare diff --git a/openmeetings-server/pom.xml b/openmeetings-server/pom.xml index 4fb9172c43..966e7cc7f3 100644 --- a/openmeetings-server/pom.xml +++ b/openmeetings-server/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-server @@ -46,7 +46,7 @@ scm:git:https://github.com/apache/openmeetings.git scm:git:https://github.com/apache/openmeetings.git - https://github.com/apache/openmeetings.git + https://github.com/apache/openmeetings/tree/7.1.0 HEAD diff --git a/openmeetings-server/src/site/xdoc/NewsArchive.xml b/openmeetings-server/src/site/xdoc/NewsArchive.xml index cec59e08ea..caf242b403 100644 --- a/openmeetings-server/src/site/xdoc/NewsArchive.xml +++ b/openmeetings-server/src/site/xdoc/NewsArchive.xml @@ -20,6 +20,40 @@ +
+
+
Version 7.0.0 released!
+
Release 7.0.0, provides following improvements:
+
+
+ IMPORTANT: Java 17 is required +
+ + UI and Security: +
    +
  • Microphone on/off doesn't interrupt the streaming
    • +
  • Stability fix at Safari
    • +
  • Full screen mode for WB
    • +
  • Redo tool for WB
    • +
  • 2-factor authentication
    • +
  • Libraries are updated with most recent versions
    • +
+
+
1 security vulnerability was addressed
+
+ Other fixes and improvements +
+
+ + + 28 issues are fixed please check
+ CHANGELOG and + Detailed list + + See Archived download. + (2023-02-11) +
+
Version 6.3.0 released!
diff --git a/openmeetings-server/src/site/xdoc/downloads.xml b/openmeetings-server/src/site/xdoc/downloads.xml index a0720cce32..e591352769 100644 --- a/openmeetings-server/src/site/xdoc/downloads.xml +++ b/openmeetings-server/src/site/xdoc/downloads.xml @@ -32,21 +32,21 @@

- Apache OpenMeetings 7.0.0 + Apache OpenMeetings 7.1.0

-
Version 7.0.0 released!
-
Release 7.0.0, provides following improvements:
+
Version 7.1.0 released!
+
Release 7.1.0, provides following improvements:

- IMPORTANT: Java 17 is required + IMPORTANT: Java 17 and KMS 6.18.0+ are required
- UI and Security: + Security:
    -
  • Microphone on/off doesn't interrupt the streaming
    • -
  • Stability fix at Safari
    • -
  • Full screen mode for WB
    • -
  • Redo tool for WB
    • -
  • 2-factor authentication
    • -
  • Libraries are updated with most recent versions
    • +
  • Invitation hash check made strict
    • +
  • Set of user permissions is fixed
    • +
  • Paths entered in Admin->Config are being verified
    • +
  • All dependencies are updated with most recent versions
+ + Stability: +
    +
  • TURN server config is passed to the client
    • +
+
+
3 security vulnerabilities were addressed

Other fixes and improvements

- 28 issues are fixed please check
- CHANGELOG and - Detailed list + 12 issues are fixed please check
+ CHANGELOG and + Detailed list See Downloads page. - (2023-02-11) + (2023-05-09)
You can find older news here diff --git a/openmeetings-server/src/site/xdoc/security.xml b/openmeetings-server/src/site/xdoc/security.xml index e210ccf911..db681a6577 100644 --- a/openmeetings-server/src/site/xdoc/security.xml +++ b/openmeetings-server/src/site/xdoc/security.xml @@ -45,12 +45,45 @@ Please NOTE: only security issues should be reported to this list.

+
+

Severity: Critical

+

Vendor: The Apache Software Foundation

+

Versions Affected: from 2.0.0 before 7.1.0

+

Description: Attacker can access arbitrary recording/room
+ CVE-2023-28936 +

+

The issue was fixed in 7.1.0
+ All users are recommended to upgrade to Apache OpenMeetings 7.1.0

+

Credit: This issue was identified by Stefan Schiller

+
+
+

Severity: Important

+

Vendor: The Apache Software Foundation

+

Versions Affected: from 3.1.3 before 7.1.0

+

Description: An attacker that has gained access to certain private information can use this to act as other user.
+ CVE-2023-29032 +

+

The issue was fixed in 7.1.0
+ All users are recommended to upgrade to Apache OpenMeetings 7.1.0

+

Credit: This issue was identified by Stefan Schiller

+
+
+

Severity: Important

+

Vendor: The Apache Software Foundation

+

Versions Affected: from 2.0.0 before 7.0.0

+

Description: An attacker who has gained access to an admin account can perform RCE via null-byte injection
+ 2023-29246 +

+

The issue was fixed in 7.1.0
+ All users are recommended to upgrade to Apache OpenMeetings 7.1.0

+

Credit: This issue was identified by Stefan Schiller

+

Severity: Critical

Vendor: The Apache Software Foundation

Versions Affected: from 2.0.0 before 7.0.0

Description: Attacker can elevate their privileges in any room
- CVE-2023-28326 + CVE-2023-28326

The issue was fixed in 7.0.0
All users are recommended to upgrade to Apache OpenMeetings 7.0.0

@@ -61,7 +94,7 @@

Vendor: The Apache Software Foundation

Versions Affected: from 4.0.0 before 6.0.0

Description: NetTest web service can be used to overload the bandwidth of the server
- CVE-2021-27576 + CVE-2021-27576

The issue was fixed in 6.0.0
All users are recommended to upgrade to Apache OpenMeetings 6.0.0

@@ -72,7 +105,7 @@

Vendor: The Apache Software Foundation

Versions Affected: from 4.0.0 before 5.0.1

Description: NetTest web service can be used to perform Denial of Service attack
- CVE-2020-13951 + CVE-2020-13951

The issue was fixed in 5.0.1
All users are recommended to upgrade to Apache OpenMeetings 5.0.1

@@ -83,7 +116,7 @@

Vendor: wicket-jquery-ui

Versions Affected: <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1

Description: JS code created in WYSIWYG editor will be executed on display
- CVE-2018-1325 + CVE-2018-1325

The issue was fixed in 6.29.1, 7.10.2, 8.0.0-M9.2
All users are recommended to upgrade to Apache OpenMeetings 4.0.3

@@ -94,7 +127,7 @@

Vendor: wicket-jquery-ui

Versions Affected: <= 6.28.0, <= 7.9.1, <= 8.0.0-M8

Description: Attacker can submit arbitrary JS code to WYSIWYG editor
- CVE-2017-15719 + CVE-2017-15719

The issue was fixed in 6.28.1, 7.9.2, 8.0.0-M8.1
All users are recommended to upgrade to Apache OpenMeetings 4.0.2

@@ -106,7 +139,7 @@

Versions Affected: from 3.0.0 before 4.0.2

Description: CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.
- CVE-2018-1286 + CVE-2018-1286

The issue was fixed in 4.0.2
All users are recommended to upgrade to Apache OpenMeetings 4.0.2

@@ -117,7 +150,7 @@

Vendor: The Apache Software Foundation

Versions Affected: 3.2.0

Description: Both global and Room chat are vulnerable to XSS attack
- CVE-2017-7663 + CVE-2017-7663

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -128,7 +161,7 @@

Vendor: The Apache Software Foundation

Versions Affected: from 3.1.0 before 3.3.0

Description: Uploaded XML documents were not correctly validated
- CVE-2017-7664 + CVE-2017-7664

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -140,7 +173,7 @@

Versions Affected: from 1.0.0 before 3.3.0

Description: Apache Openmeetings is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks
- CVE-2017-7666 + CVE-2017-7666

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -153,7 +186,7 @@

Description: Apache OpenMeetings uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection
- CVE-2017-7673 + CVE-2017-7673

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -166,7 +199,7 @@

Description: Apache OpenMeetings has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
- CVE-2017-7680 + CVE-2017-7680

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -180,7 +213,7 @@ This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end
- CVE-2017-7681 + CVE-2017-7681

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -192,7 +225,7 @@

Versions Affected: 3.2.0

Description: Apache OpenMeetings is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
- CVE-2017-7682 + CVE-2017-7682

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -204,7 +237,7 @@

Versions Affected: from 1.0.0 before 3.3.0

Description: Apache OpenMeetings displays Tomcat version and detailed error stack trace which is not secure.
- CVE-2017-7683 + CVE-2017-7683

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -217,7 +250,7 @@

Description: Apache OpenMeetings doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server
- CVE-2017-7684 + CVE-2017-7684

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -229,7 +262,7 @@

Versions Affected: from 1.0.0 before 3.3.0

Description: Apache OpenMeetingsrespond to the following insecure HTTP Methods: PUT, DELETE, HEAD, and PATCH.
- CVE-2017-7685 + CVE-2017-7685

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -240,7 +273,7 @@

Vendor: The Apache Software Foundation

Versions Affected: from 1.0.0 before 3.3.0

Description: Apache OpenMeetings updates user password in insecure manner.
- CVE-2017-7688 + CVE-2017-7688

The issue was fixed in 3.3.0
All users are recommended to upgrade to Apache OpenMeetings 3.3.0

@@ -253,7 +286,7 @@

Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
- CVE-2017-5878 + CVE-2017-5878

The issue was fixed in 3.1.4
All users are recommended to upgrade to Apache OpenMeetings 3.1.4

@@ -264,7 +297,7 @@

Vendor: The Apache Software Foundation

Versions Affected: from 3.1.0 before 3.1.2

Description: Apache Openmeetings is vulnerable to Remote Code Execution via RMI deserialization attack
- CVE-2016-8736 + CVE-2016-8736

The issue was fixed in 3.1.2
All users are recommended to upgrade to Apache OpenMeetings 3.1.3

@@ -276,7 +309,7 @@

Versions Affected: from 3.1.0 before 3.1.2

Description: The value of the URL's "swf" query parameter is interpolated into the JavaScript tag without being escaped, leading to the reflected XSS.
- CVE-2016-3089 + CVE-2016-3089

All users are recommended to upgrade to Apache OpenMeetings 3.1.2

Credit: This issue was identified by Matthew Daley

@@ -289,7 +322,7 @@ name and the current system time, and then hashing it using MD5. This is highly predictable and can be cracked in seconds by an attacker with knowledge of the user name of an OpenMeetings user.
- CVE-2016-0783 + CVE-2016-0783

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh

@@ -305,7 +338,7 @@ directory. This could be used to, for example, overwrite the /usr/bin/convert file (or any other 3 rd party integrated executable) with a shell script, which would be executed the next time an image file is uploaded and imagemagick is invoked.
- CVE-2016-0784 + CVE-2016-0784

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh

@@ -319,7 +352,7 @@ possible to create a link like "javascript:alert('xss')", which will execute once the link is clicked. As the link is placed within an <a> tag, the actual link is not visible to the end user which makes it hard to tell if the link is legit or not.
- CVE-2016-2163 + CVE-2016-2163

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh

@@ -331,7 +364,7 @@

Description: When attempting to upload a file via the API using the importFileByInternalUserId or importFile methods in the FileService, it is possible to read arbitrary files from the system. This is due to that Java's URL class is used without checking what protocol handler is specified in the API call.
- CVE-2016-2164 + CVE-2016-2164

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh

diff --git a/openmeetings-service/pom.xml b/openmeetings-service/pom.xml index 335bbc1cf5..9bbc1dd4cf 100644 --- a/openmeetings-service/pom.xml +++ b/openmeetings-service/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-service diff --git a/openmeetings-util/pom.xml b/openmeetings-util/pom.xml index e8261877b6..18143c2b98 100644 --- a/openmeetings-util/pom.xml +++ b/openmeetings-util/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-util diff --git a/openmeetings-web/pom.xml b/openmeetings-web/pom.xml index 963359f8de..dd41f26e60 100644 --- a/openmeetings-web/pom.xml +++ b/openmeetings-web/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-web diff --git a/openmeetings-webservice/pom.xml b/openmeetings-webservice/pom.xml index 2f9912f620..e054a0c1a4 100644 --- a/openmeetings-webservice/pom.xml +++ b/openmeetings-webservice/pom.xml @@ -22,7 +22,7 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 .. openmeetings-webservice diff --git a/pom.xml b/pom.xml index 1abf56b490..4220f46ae9 100644 --- a/pom.xml +++ b/pom.xml @@ -26,12 +26,13 @@ org.apache.openmeetings openmeetings-parent - 7.1.0-SNAPSHOT + 7.1.0 pom Openmeetings Parent project for all OpenMeetings Maven modules. Required to hold general settings UTF-8 + 2023-05-05T03:25:03Z DEPLOYMENT false true @@ -351,7 +352,7 @@ scm:git:https://github.com/apache/openmeetings.git scm:git:https://github.com/apache/openmeetings.git - https://github.com/apache/openmeetings.git + https://github.com/apache/openmeetings/tree/7.1.0 HEAD