imported>Rvogel1 Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-06-08 |- |Severity |reported "medium/high", BlueSpice assessment: '''not affected''' |- |Affected |Cloudogu Container Images (library present, not exploitable) |- |Fixed in |Next regular update |- |CVE | * [https://nvd.nist.gov/vuln/detail/CVE-2026-31789 CVE-2026-31789] * [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512] * [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261] |- |Validated by |RV, FS |}..." |
imported>Rvogel1 No edit summary |
||
| Line 21: | Line 21: | ||
* [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512] | * [https://nvd.nist.gov/vuln/detail/CVE-2026-43512 CVE-2026-43512] | ||
* [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261] | * [https://nvd.nist.gov/vuln/detail/CVE-2026-7261 CVE-2026-7261] | ||
|} | |} | ||
| Line 32: | Line 29: | ||
!'''Type of vulnerability''' | !'''Type of vulnerability''' | ||
!'''BlueSpice 5''' | !'''BlueSpice 5''' | ||
|- | |- | ||
|CVE-2026-31789 | |CVE-2026-31789 | ||
|<code>hallowelt/bluespice-mathoid</code>, <code>hallowelt/bluespice-collabpadsbackend</code>, <code>hallowelt/mongodb</code> | |<code>hallowelt/bluespice-mathoid</code>, <code>hallowelt/bluespice-collabpadsbackend</code>, <code>hallowelt/mongodb</code> | ||
|Heap Buffer Overflow (OpenSSL, 32-bit only) | |Heap Buffer Overflow (OpenSSL, 32-bit only) | ||
| style="" class="col-green-bg" |not affected | | style="" class="col-green-bg" |not affected | ||
|- | |- | ||
| Line 43: | Line 38: | ||
|<code>hallowelt/bluespice-pdfrenderer</code>, <code>hallowelt/drawio</code> | |<code>hallowelt/bluespice-pdfrenderer</code>, <code>hallowelt/drawio</code> | ||
|Authentication Bypass (Apache Tomcat DIGEST) | |Authentication Bypass (Apache Tomcat DIGEST) | ||
| style="" class="col-green-bg" |not affected | | style="" class="col-green-bg" |not affected | ||
|- | |- | ||
| Line 49: | Line 43: | ||
|<code>hallowelt/bluespice</code> | |<code>hallowelt/bluespice</code> | ||
|PHP SOAP Server Session Persistence | |PHP SOAP Server Session Persistence | ||
| style="" class="col-green-bg" |not affected | | style="" class="col-green-bg" |not affected | ||
|} | |} | ||
Latest revision as of 09:02, 8 June 2026
| Date | 2026-06-08 |
| Severity | reported "medium/high", BlueSpice assessment: not affected |
| Affected | Cloudogu Container Images (library present, not exploitable) |
| Fixed in | Next regular update |
| CVE |
Problem
| CVE | Component | Type of vulnerability | BlueSpice 5 |
|---|---|---|---|
| CVE-2026-31789 | hallowelt/bluespice-mathoid, hallowelt/bluespice-collabpadsbackend, hallowelt/mongodb |
Heap Buffer Overflow (OpenSSL, 32-bit only) | not affected |
| CVE-2026-43512 | hallowelt/bluespice-pdfrenderer, hallowelt/drawio |
Authentication Bypass (Apache Tomcat DIGEST) | not affected |
| CVE-2026-7261 | hallowelt/bluespice |
PHP SOAP Server Session Persistence | not affected |
Impact assessment
| CVE | Assessment | Mitigation without update |
|---|---|---|
| CVE-2026-31789 | Not affected. The vulnerability only applies to 32-bit platforms. Additionally, the way OpenSSL is used in the affected container images does not expose any exploitable attack surface. | No action required. |
| CVE-2026-43512 | Not affected. Neither bluespice-pdfrenderer nor drawio use DIGEST authentication. Access to both services is anonymous by design. |
No action required. |
| CVE-2026-7261 | Not affected. BlueSpice does not use a PHP SOAP server, and the affected SOAP_PERSISTENCE_SESSION setting is not in use. |
No action required. |
Solution
No immediate action required. The affected libraries will be updated in the next regular release.
