The Atlassian Community Forums are currently in read-only mode. We will be relaunching on a new platform on September 22 (read more here). We apologize for the extended downtime. For concerns or questions, please email communitymanagers@atlassian.com. See you on the other side, on the new Atlassian Community Forums! :)

×
Forums
Home Q&A Discussion groups Articles Ask a question Search
Learning
Events
Champions
Release Notes
Community
Forums
Home Q&A Discussion groups Articles Ask a question Search
Learning Events Champions Release Notes
Forums
Home Q&A Discussion groups Articles Ask a question Search
Learning Events Champions Release Notes

Forums

Articles
Create
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Q&A
See all
Community resources
Top groups
Explore all groups
Community resources
Learn
Community resources
Events
Community resources

Is Bitbucket Server affected by Apache Commons Text ver 1.5-1.9? (CVE-2022-42889)

vhoutgraaf
vhoutgraaf
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
Get involved
October 19, 2022

See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889

 

Watch
Like # people like this
2424 views

2 answers

1 accepted

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

0 votes
Answer accepted
Christian Glockner
Christian Glockner
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
October 20, 2022

Hi,

Our security team is aware of this issue and are currently investigating any potential impact to our products. As a per our security advisory publishing policy, if this issue has a critical severity impact with any of our products, we will send a security advisory alert.

Cheers,

Christian

Premier Support Engineer

Atlassian

Reply
1 vote
Christian Glockner
Christian Glockner
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
October 21, 2022

Our security team has assessed this vulnerability and determined that Bitbucket Server is not vulnerable as it does not use the StringSubstitutor interpolator.

Products using an impacted versions of Apache Commons Text will be updated in accordance with our Data Center and Server Bug Fix Policy.

Reply
Bitbucket
Bitbucket
TAGS
AUG Leaders

Atlassian Community Events

    See all events
    Community
    Forums
    FAQs Forums guidelines
    Learning
    About learning Resources
    Events
    Champions
    Release Notes
    Copyright © 2026 Atlassian
    Privacy Policy Notice at Collection Terms Security