CVE fixes? - Githubissues

jitsi / jitsi

Jitsi is an audio/video and chat communicator that supports protocols such as SIP, XMPP/Jabber, IRC and many other useful features.

https://desktop.jitsi.org

Apache License 2.0

4.16k stars 970 forks source link

CVE fixes? #745

Open Neustradamus opened 3 years ago

Neustradamus commented 3 years ago

It is possible to secure Jitsi?

CVEs:

Bouncy Castle CVEs: https://github.com/jitsi/jitsi/issues/562 + https://github.com/jitsi/jitsi/pull/564 + https://github.com/jitsi/jitsi/pull/741
slf4j CVE: https://github.com/jitsi/jitsi/pull/667
log4j CVEs: https://github.com/jitsi/jitsi/issues/754 + https://github.com/jitsi/jitsi/issues/753
...

cc: @TechByTom, @mpexo, @jvkassi, @mjmeijerman.

Neustradamus commented 2 years ago

Bouncy Castle CVEs: https://github.com/jitsi/jitsi/issues/562 + https://github.com/jitsi/jitsi/pull/564 + https://github.com/jitsi/jitsi/pull/741
slf4j CVE: https://github.com/jitsi/jitsi/pull/667
log4j CVEs: https://github.com/jitsi/jitsi/issues/754 + https://github.com/jitsi/jitsi/issues/753
...

cc: @TechByTom, @mpexo, @jvkassi, @mjmeijerman.

Neustradamus commented 1 year ago

@JonathanLennox, @sawall, @nils-ohlmeier: After a long time, there are changes for security etc.! All are not up-to-date, but better, thanks!

jitsi

libjitsi

jibri

zrtp4j

jitsi-videobridge

moderated-meetings

jigasi

jitsi-srtp

otr4j

OLD:

jitsi-media-transform (Integrated in jitsi-videobridge)

jitsi-hammer

bccontrib

jitsi-universe-public

Neustradamus commented 1 year ago

Currently not up-to-date:

Neustradamus commented 1 year ago

Bouncy Castle has a new release: 1.76:

cc: @JonathanLennox, @sawall, @nils-ohlmeier