Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. The remainder are addressed with this patch. Impact Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. Patches This issue is fixed in Opencast 17.6 If you have any questions or comments about this advisory: - Open an issue in our issue tracker - Email us at security@opencast.org
Recommended action: Upgrade to 17.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. Impact The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues. Patches This issue is fixed in Opencast 12.5 and newer References Patch fixing the issue If you have any questions or comments about this advisory: Open an issue in our issue tracker Email us at security@opencast.org
Recommended action: Upgrade to 12.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The issue was mostly mitigated before, drastically reducing the risk. See references below for more information. Impact Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system user's credentials, regardless of the target being part of the Opencast cluster or not. Previous mitigations already prevented clear text authentications for such requests (e.g. HTTP Basic authentication), but with enough malicious intent, even hashed credentials can be broken. Patches Opencast 10.6 will now send authentication requests only against servers which are part of the Opencast cluster, preventing external services from getting any form of authentication attempt in the first place. Workarounds No workaround available. References - Patch fixing the issue - Original security notice - Original security mitigation For more information If you have any questions or comments about this…
Recommended action: Upgrade to 10.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. Impact The vulnerability allows attackers to craft links or forms which may change the server state. For example, the following GET request would create a new user: If an admin is logged in to legacy.opencast.org and accidentally clicks this link, a user will silently be created. Patches This issue is fixed in Opencast 9.10 and 10.0. Workarounds You can mitigate the problem by setting the SameSite=Strict attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case. References - Fix for 10.0 - Fix for 9.10 For more information…
Recommended action: Upgrade to 9.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Opencast uses an Apache Log4j2 version which, combined with older JDK versions, can be used for remote code execution attacks which have been found to be actively exploited. Apache Log4j2 <=2.14.1 JNDI features is not sufficiently protected. An attacker who can control log messages or log message parameters can execute arbitrary code when message lookup substitution is enabled. Who is affected - Opencast before 9.10 or 10.6 are affected - Log4j version: all 2.x versions before 2.15.0 are affected Patches The issue has been fixed in Opencast 9.10 and 10.6. Workarounds The vulnerability can be mitigated by setting system property log4j2.formatMsgNoLookups to true. References - Opencast pull request mitigating the vulnerability - CVE-2021-44228 Detail - Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability - VE-2021-44228 – Log4j 2 Vulnerability Analysis For more information If you have any questions or comments about this advisory: Open an…
Recommended action: Upgrade to 10.6 or 9.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.