OSGeo
Security incidents tagged OSGeo. Newest first.
0 OSGeo incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 829
- Longest quiet run: 829 days (Jul 16–Oct 22)
Show 2 older incidents2 older incidents
July 2024 1
CriticalOSGeo GeoServer GeoTools Eval InjectionPatched
OSGeo GeoServer Patched
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.
Open incident →CVE-2024-36401
June 2024 1
CriticalOSGeo GeoServer JAI-EXT Code InjectionPatched
OSGeo JAI-EXT Patched
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-24816 was assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2022-24816
