Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Bamboo and CVE-2018-11776 (Apache Struts) vulnerability

Dear Atlassian Team

On this page there's a brief message that no Atlassian product is impacted by CVE-2018-11776. However, to keep our Risk & Governance stakeholders suitably informed, would it please be possible for Atlassian to release an advisory confirming there's no impact and positively confirming that this is true for Bamboo as well?

It would be very useful to have official comms on this (vs a comment on a forum).

Given this is an RCE (remote code exection) vuln organizations with automated scanners are flagging Bamboo as vulnerable. An advisory will help ensure that teams using Bamboo can continue to do so confidently.

Thank you!

1 answer

1 accepted

2 votes
Answer accepted

Hi Prasenjeet,

There are new security issues found every day, so we don't generally release advisories to say that an issue doesn't affect one of our products. 

Our security team has investigated CVE-2018-11776 and we can confirm that no Atlassian products are affected by this vulnerability -- this includes Bamboo. While we do use Struts for some products, they are not configured in a way that would leave them open to this bug. But as an extra precaution, we are updating all of the products that use Struts to the latest version.

Which security scanner are you running that is incorrectly flagging Bamboo?

Adrian 

Atlassian Security

Added to my colleague's inputs, I just wanted to update that as an extra precaution that is in-line with industry best practices, the next release - Bamboo 6.7 will contain the latest updated Struts jar in it (even though Bamboo is not affected by this vulnerability).

This is expected to be released in the coming weeks on September 2018. So I suggest you wait and upgrade your Bamboo if you want. This is tracked here - Upgrade Struts to 2.5.17.

Hope that helps.

Cheers,
Jey

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Bamboo

Bamboo 101 Video

G’day Community! As we gear up to introduce Bamboo Data Center to the world, we wanted to make sure that we shared a bit more about Bamboo, the product. Our team has put together an overview video ...

186 views 4 6
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you