BigBlueButton 3.0.35 released! security patches only

[Anton Georgiev]

This iteration of BigBlueButton 3.0 contains security fixes only.
We strongly encourage administrators to update!

Read the release notes and the advisory entirely, please!

The full release notes are here
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.35

If you want to report any potential security issues with BigBlueButton, please check https://github.com/bigbluebutton/bigbluebutton/security/policy#reporting-a-vulnerability

As always, we welcome feedback on this latest update.
Anton and team

[Hiroshi Suga]

hi anton,

If we are not using Etherpad, do we not need to upgrade immediately?

[Anton Georgiev]

If you have `bbb-etherpad` installed, you _need_ to upgrade [or follow the workaround from the advisory]. It's not about using it but having the configuration active.

i.e. Everyone with BBB servers needs to do maintenance asap.

Anton Georgiev 
Project Manager | Software Developer
Blindside Networks Inc.
 blindsidenetworks.com
 anton.g...@blindsidenetworks.com
 130 Albert St Suite #10, Ottawa, ON K1P 5G4

--
You received this message because you are subscribed to a topic in the Google Groups "BigBlueButton-dev" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/bigbluebutton-dev/DlFIoXi9Mhk/unsubscribe.
To unsubscribe from this group and all its topics, send an email to bigbluebutton-...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bigbluebutton-dev/864ac533-36dd-4d25-ae4b-3958b285bba3n%40googlegroups.com.

[Daniel Schröter]

Hello Security-Experts,

in

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c

Privileges required is None (PR:N)

Is it possible for non BBB User to attack this etherpad bug?

Thanks!

[Felipe Cecagno]

Yes.

--

   Felipe Cecagno

--
You received this message because you are subscribed to the Google Groups "BigBlueButton-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bigbluebutton-...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bigbluebutton-dev/ce3145af-6368-4e54-87b9-dea0d0facddcn%40googlegroups.com.

[Daniel Schröter]

Felipe Cecagno schrieb am Samstag, 15. August 2026 um 14:51:24 UTC+2:

Yes.

Whoa :-(

We are still running (unsupported) 2.7 as we have problems with iOS devices as presenter in 3.0

Is there a workaround for 2.7? We don't need etherpad (notes). Can we block it via configuration? The mentioned workaround with bbb-shared-notes-server is not available in 2.7.

Thanks!

[Hiroshi Suga]

I did the nginx entrypoint drop for etherpad on my old 2.7: https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c
I am not sure if it's sufficient. Obviously turning off the server would be a final solution...

[Fred Dixon]

Hi,

>  https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c

...

> I am not sure if it's sufficient.

I recommend fully removing etherpad and the notes.nginx directive (and reload nginx).

> We are still running (unsupported) 2.7 as we have problems with iOS devices as presenter in 3.0

Since 2.7 is no longer supported and has not received updates for many months,  I strongly encourage everyone to upgrade.  

For evidence, we've been running 3.0.for over 18 months now in production and has become increasingly stable, scalable, and secure over that time.  Much of the improvement is based on real-world feedback from our users, our community, and security researchers.

2.7 was a great release, but it's time to move on.

Regards,... Fred

--

You received this message because you are subscribed to the Google Groups "BigBlueButton-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bigbluebutton-...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/bigbluebutton-dev/f0a822d3-f058-41a4-a957-4e5caee09a48n%40googlegroups.com.

--

Co-founder BigBlueButton

https://bigbluebutton.org/

Like BigBlueButton?  Tweet us at @bigbluebutton

[Daniel Schröter]

Hiroshi Suga schrieb am Sonntag, 16. August 2026 um 08:50:46 UTC+2:

I did the nginx entrypoint drop for etherpad on my old 2.7: https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4g74-4wqf-fr8c

Is the  entrypoint mentioned in the security advisory? I can not see it. Can you provide here your nginx configuration? Otherwise I have to debug it with the developer tools from the browser.

Thanks in advanced! 

[Daniel Schröter]

Fred Dixon schrieb am Sonntag, 16. August 2026 um 14:04:09 UTC+2:

2.7 was a great release, but it's time to move on.

Yes, but as mentioned already: We have issues with iOS devices on 3.0 which we don't have on 2.7. E.g

https://github.com/bigbluebutton/bigbluebutton/issues/23593

and the app is AFAIK still not ready

https://github.com/bigbluebutton/bigbluebutton/issues/22754 

Bye

[Daniel Schröter]

BTW: From the patch

https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/refs/heads/v3.0.x-release/build/packages-template/bbb-etherpad/fix-etherpad-static-serving.patch
the line 
filename = filename.replace(/\\/g, '/');
is also available in 2.7. Should replacing this line with
if (path.sep === '\\') filename = filename.replace(/\\/g, '/');
fix this security bug also in 2.7?

Bye

[Daniel Schröter]

Daniel Schröter schrieb am Sonntag, 16. August 2026 um 08:29:55 UTC+2:

Is there a workaround for 2.7?

If someone else need it for 2.7.

Option a: The patch looks very similar to 2.7. IMHO you can replace the line.

Option b, if you don't need etherpad you can add this to your nginx configuration

location ^~ /pad/ {
        deny all;
        return 403;
}

If you didn't add it to the top you have to (re)move /usr/share/bigbluebutton/nginx/notes.nginx