BigBlueButton v3.0.37

This iteration of BigBlueButton 3.0 contains security fixes only. We encourage administrators to update!

Note, we drop support for SIP.JS audio (/ws) here as part of one of the patches. BigBlueButton 4.0 already had it dropped. A corresponding change in bbb-install.sh (v3.0.x-release branch) was made too.

For those using custom installers, make sure /usr/share/bigbluebutton/nginx/sip.nginx is not being reintroduced!

More details included in the advisories below. Note, if they are not yet public when reading this, check a bit later.

Core

• Cross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
• Cross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
• Cross Meeting Page IDOR https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-mvx6-hg8v-3x4j
• GetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467
• Improper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p

Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v3.0.36...v3.0.37

Release name

Passing -v jammy-300 to https://github.com/bigbluebutton/bbb-install/blob/v3.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 3.0 version.

If for some reason you would like to install this specific release, pass -v jammy-300-3.0.37.

We still recommend using -v jammy-300 as this repository is continually updated with each BigBlueButton 3.0 release.