BigBlueButton 3.0.36 → 4.0.0
4 releases · 0 breaking changes · 14 security fixes · 14 advisories fixed
14security0breaking0deprecated2feature5fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-5p2g-ff34-ghm3 Breakout room access is not revoked after a participant is removed
- 3.1 GHSA-x795-r9c3-rh9q Whiteboard annotation authorship could be forged by a participant with whiteboard access
- 7.3 GHSA-h6m5-4xgx-pvpp Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player
- 4.3 GHSA-52cv-pvw8-89c6 Hidden user list can be bypassed through voice and reaction data
- 5.0 GHSA-rr62-cx93-4fwh Unescaped poll text in presentation export enables SVG injection and server-side request forgery
- 4.3 GHSA-j5gq-h48h-23r4 Live meeting streams remain accessible to a removed participant
- 4.3 GHSA-gjvc-jq4g-58xp BlockNote shared notes accessible to non-members of a meeting
- 9.0 GHSA-f6gw-hpfv-5gxg Command Injection through "destination_number"
- 7.0 GHSA-49qg-pcv3-r2g6 Unauthenticated access to a meeting's audio conference
- 4.3 GHSA-c4v9-6mvh-px5p Improper enforcement of plugin role restrictions on custom chat messages
- 7.6 GHSA-8p8h-cw52-x467 GetJoinUrl Parameter Injection and Checksum Pollution
- 4.3 GHSA-mvx6-hg8v-3x4j Cross Meeting Page IDOR
- 4.3 GHSA-9v52-vhvw-4w5c Cross-Meeting Presentation Injection Due to an Unbound Upload Token
- 7.1 GHSA-g92v-3w29-55rh Cross-meeting audio access via unvalidated voice bridge
Breaking changes
None in the release notes.
Security changes
- security Command Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg in 3.0.38
- security Unauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6 in 3.0.38
- security BlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp in 3.0.38
- security Live meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4 in 3.0.38
- security Unescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh in 3.0.38
- security Hidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6 in 3.0.38
- security Breakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3 in 3.0.38
- security Whiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q in 3.0.38
- security Stored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp in 3.0.38
- security Fixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR in 3.0.37
- security Cross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh in 3.0.37
- security Cross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c in 3.0.37
- security GetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467 in 3.0.37
- security Improper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p in 3.0.37
Every release in between
featureRedesigned client interface with a new navigation sidebar and an Apps Gallery, where apps and plugins can be pinned, searched and shown as a list or a grid
otherSearch in the user list, a redesigned timer, a dedicated guest management panel, a redesigned permissions (lock viewers) modal and an overhauled mobile layout
otherAutomatic light/dark theme following the operating system, and a dedicated Audio settings tab with Advanced Filtering (WASM noise suppression), Standard Filtering and Original Audio modes
otherRequest to Present: viewers can ask for the presenter role and moderators approve or deny (lockSettingsPresenterPolicy)
otherPinned chat messages, larger emoji-only messages, optional user consent before a moderator unmutes them, and a Multi-Functional Mode that opens two sidebar panels side by side
otherLearning Dashboard for breakout rooms, with per-breakout data kept until the parent meeting ends
otherLiveKit is the default media framework for audio, cameras and screen sharing; bbb-webrtc-sfu and FreeSWITCH stay installed and can be selected per meeting or server-wide
otherBlockNote is the only shared notes editor; Etherpad is no longer installed
otherPlugin SDK 1.0 (bigbluebutton-html-plugin-sdk 1.0.0-beta.3)
otherdocs: 4.0.0 preparations
fixFix(html5): Move and add button are still shown if cursor is outside of the shared notes
other[3.0 presentation toolbar] fix: darkmode-aware CSS for infinite WB button
other[3.0]fix(waiting-users): order the guest lobby list by time of arrival
feature[3.0 WB] fix: add trailing to throttling for cursor updates
fixfix(video-provider): clear stale grid avatars when a presentation is open (3.0)
otherci(plugin/test): added test infrastructure for the plugins
other[3.0]test(breakout): stabilize lock-settings tests under load
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/25934
other[3.0 backport] fix: Upload error toast for a rejected presentation can't be dismissed and keeps reappearing
fixfix(akka-apps): Allow Locked Users to See Moderator Voice State
other[3.0]fix(export): render annotated slide backgrounds from the source PDF
other[3.0]fix(export-annotations):Fix export soft mask followups 30
fixfix(bbb-export-annotations): set xml:space through the XML namespace
other[3.0 backport] fix(bbb-export-annotations): prevent exported text overlap for width-constrained shapes
fixfix(recording): include sanitizeChatHTML in video playback
other[3.0 port] fix(recording): don't blank the presentation on screenshare-as-content
other[3.0 backport] fix(recording): use instance variable for segment break timestamp
other[3.0 port] fix(rap): hide every camera of a locked user in recordings- #25889
otherbuild(bbb-presentation-video): Update to 5.1.0-rc.4
otherbuild: Update bbb-playback from 5.4.7 to v5.4.8
otherdocs: Add recent releases in new-features.md
otherdocs: Catch-up on missed docs changes in BBB 3.0.33..39
otherbuild(deps-dev): bump postcss-selector-parser from 6.1.0 to 6.1.4 in /bbb-graphql-client-test
otherbuild(deps-dev): bump browserslist from 4.28.1 to 4.28.8 in /bbb-graphql-client-test
otherbuild(deps): bump sanitize-html from 2.17.6 to 2.17.7 in /bigbluebutton-html5
otherbuild(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /bbb-graphql-client-test
otherbuild(deps-dev): bump fast-uri from 3.1.4 to 3.1.7 in /bigbluebutton-html5
otherbuild(deps): bump qs from 6.15.2 to 6.16.0 in /bbb-shared-notes-server
otherbuild(deps): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-shared-notes-server
otherbuild(deps): bump colord from 2.9.2 to 2.10.0 in /bbb-learning-dashboard
otherchore: Merge 3.0.37 into v3.0.x develop
otherbuild(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /bbb-export-annotations
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /docs
otherbuild(deps): bump fast-uri from 3.1.6 to 3.1.8 in /bbb-learning-dashboard
otherbuild(deps): bump image-size and svgdom in /bbb-export-annotations
otherbuild(deps): bump image-size from 2.0.2 to 2.0.4 in /docs
otherbuild(deps): bump ip-address from 10.4.0 to 10.7.2 in /bbb-shared-notes-server
otherchore: Forward port BBB 3.0.38 into v3.0.x-develop
otherchore(client): bump tldraw to 2.0.0-alpha.36
+1 more item in the release notessecurityCommand Injection through "destination_number" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-f6gw-hpfv-5gxg
securityUnauthenticated access to a meeting's audio conference https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-49qg-pcv3-r2g6
securityBlockNote shared notes accessible to non-members of a meeting https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gjvc-jq4g-58xp
securityLive meeting streams remain accessible to a removed participant https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5gq-h48h-23r4
securityUnescaped poll text in presentation export enables SVG injection and server-side request forgery https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rr62-cx93-4fwh
securityHidden user list can be bypassed through voice and reaction data https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-52cv-pvw8-89c6
securityBreakout room access is not revoked after a participant is removed https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5p2g-ff34-ghm3
securityWhiteboard annotation authorship could be forged by a participant with whiteboard access https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x795-r9c3-rh9q
securityStored XSS Through an Unvalidated Audio-Caption Locale in the Legacy Recording Player https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h6m5-4xgx-pvpp
securityFixes GHSA-mvx6-hg8v-3x4j: Cross Meeting Page IDOR
securityCross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
securityCross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
securityGetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467
securityImproper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p