topic Re: Unpatched security vulnerabilities in Activiti in Alfresco Archive

Unpatched security vulnerabilities in Activiti

dfj — Wed, 18 May 2016 01:31:53 GMT

Hi AllOne of my colleagues recently discovered two security vulnerabilities in Activiti, but was unable to get a response from Alfreso and posted details on the oss-security list:http://www.openwall.com/lists/oss-security/2016/04/29/2I am making this post in the hope that someone in the development

Re: Unpatched security vulnerabilities in Activiti

jbarrez — Thu, 19 May 2016 10:02:20 GMT

Hi David, who did you contact on the Alfresco side? I haven't seen anything coming in …

Re: Unpatched security vulnerabilities in Activiti

bscarvell — Thu, 19 May 2016 23:26:44 GMT

Hey there,

I made several attempts using the Alfrecso contact form reaching out for someone to contact me privately so I could forward on the security details. I received a number of confirmation emails, but nobody ever responded to the emails.

Thanks,

Brendan

Re: Unpatched security vulnerabilities in Activiti

paulhh1 — Tue, 31 May 2016 09:41:02 GMT

Hi Brendan,

Thanks for letting us know. I can only assume that someone assumed that as Activiti Explorer is not supported in the Enterprise version, that this would be dealt with through Community channels. I will investigate to understand where the lapse came, as the Activiti team are very committed to the Activiti Community and would not want to expose anyone to security risks.

Best regards
Paul.