jitsi-meet
jitsi-meet 1.0.9365 · pkgs/by-name/ji/jitsi-meet/package.nix
Health
Risk
risk 17 medium
- +15 marked insecure: meta.knownVulnerabilities
- +2 no meta.mainProgram, no versionCheckHook
Version
1.0.9365 no newer release known to repology
Channels
Hydra
succeeded 2y ago
Advisories
none open
Packaging
meta.knownVulnerabilities no meta.mainProgram no versionCheckHook
Packagewhat each field means
Description
Secure, Simple and Scalable Video Conferences
Long description
Jitsi Meet is an open-source (Apache) WebRTC JavaScript application that uses Jitsi Videobridge
to provide high quality, secure and scalable video conferences.
License
Platforms
21 platforms: Linux, Darwin
Source provenance
not set: built from source
Outputs
outStatus
insecure
- The libolm end‐to‐end encryption library used in many Matrix clients and Jitsi Meet has been deprecated upstream, and relies on a cryptography library that has known side‐channel issues and disclaims that its implementations are not cryptographically secure and should not be used when cryptographic security is required. It is not known if the issues can be exploited over the network in practical conditions. Upstream does not believe such an attack is feasible, but has stated that the library should not be used going forward, and there are no plans to move to another cryptography implementation or otherwise further maintain the library at all. You should make an informed decision about whether to override this security warning, especially if you critically rely on end‐to‐end encryption. If you don’t care about that, or don’t use the Matrix functionality of a multi‐protocol client depending on libolm, then there should be no additional risk. Some clients are investigating migrating away from libolm to maintained libraries without known vulnerabilities. For further information, see: * The CVE records for the known vulnerabilities: * CVE-2024-45191 * CVE-2024-45192 * CVE-2024-45193 * The libolm deprecation notice: <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/README.md#important-libolm-is-now-deprecated> * The warning from the cryptography code used by libolm: <https://gitlab.matrix.org/matrix-org/olm/-/blob/6d4b5b07887821a95b144091c8497d09d377f985/lib/crypto-algorithms/README.md> * The blog post disclosing the details of the known vulnerabilities: <https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/> * The statement about the deprecation and vulnerabilities from the Matrix.org Foundation: <https://matrix.org/blog/2024/08/libolm-deprecation/> * A (likely incomplete) aggregation of client tracking issue links: <https://github.com/NixOS/nixpkgs/pull/334638#issuecomment-2289025802>
Maintainers
Teams
Version bumps 0all open bumps
None open.
Pull requests 0
None open.
Closed or merged in the synced window 2
jitsi-meet: 1.0.8792 -> 1.0.9365
#557515 by stepbrobd · merged 6w ago
jitsi-meet: 1.0.8792 -> 1.0.9367
#548649 by g0dm0d · closed 6w ago
Issues 0
None open.