Last edited 10 months ago
by Anonymous user

Security:Security Advisories/BSSA-2025-07: Difference between revisions

Back to version history
Browse history interactively
← Older editNewer edit →

imported>Fspinar

VisualWikitext
imported>Fspinar
No edit summary
imported>Fspinar
No edit summary
Line 22: Line 22:
==Problem==
==Problem==


* Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025-54988 CVE-2025-54988]
* Service <code>bluespice/search</code>- [https://nvd.nist.gov/vuln/detail/CVE-2025-66516 CVE-2025-66516]
* Service <code>bluespice/formula</code> - [https://avd.aquasec.com/nvd/2025/cve-2025-7783/ CVE-2025-7783/]
* Service <code>bluespice/wiki</code>
** PCRE: [https://avd.aquasec.com/nvd/cve-2025-58050 CVE-2025-58050]
** libxml: [https://avd.aquasec.com/nvd/cve-2025-49794 CVE-2025-49794] and [https://avd.aquasec.com/nvd/cve-2025-49796 CVE-2025-49796]




Line 34: Line 30:
** The issues has already been fixed in the upstream repository, but there was no official release yet
** The issues has already been fixed in the upstream repository, but there was no official release yet
** A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.
** A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.
* Service <code>bluespice/formula</code>
** Caused by a dependency of [https://www.npmjs.com/package/coveralls coveralls]
** Not used production code
* Service <code>bluespice/wiki</code>
** No direct usage of those libraries
** Only accessed via PHP
** Main impacts are potential information disclose and denial-of-service
*** No critical information can be disclosed


== Solution ==
== Solution ==
To mitigate <code>CVE-2025-54988</code> one can make sure the service has no access to the internet.
To mitigate <code>CVE-2025-66516</code> one can make sure the service has no access to the internet.
 
Update a soon as possible to Version 5.1.4 of the BlueSpice images
Besides this, there is currently no solution to those issues. Once the upstream vendors release fixed packages, the next patchlevel release of BlueSpice will contain them.

Revision as of 16:16, 9 December 2025

Date 2025-09-18
Severity reported "critical", BlueSpice assessment: low
Affected Services in current LTS version < 5.1.4
Fixed in fix not yet available
CVE CVE-2025-66516

Problem


Impact assessment

  • Service bluespice/search
    • The issues has already been fixed in the upstream repository, but there was no official release yet
    • A manipulated PDF file needs to be uploaded to the wiki, which usually requires an authenticated user context. The service runs only in the background and can not be accessed from outside the virtual network. It has limited access to the host system.

Solution

To mitigate CVE-2025-66516 one can make sure the service has no access to the internet. Update a soon as possible to Version 5.1.4 of the BlueSpice images

Retrieved from "https://galaxy.demo.bluespice.com/Helpdesk/index.php?title=Security:Security_Advisories/BSSA-2025-07&oldid=11187"