Bamboo and CVE-2018-1327, for Apache Struts Vulnerability?

[Brian Hecko]

Bamboo and CVE-2018-1327, for Apache Struts Vulnerability?  I see other posts where Bamboo is not susceptible to several of the Apache Struts vulns, but just want to confirm this particular CVE also.  Thanks.  We are using Nexpose as our security scanner.

[Alexey Chystoprudov · Accepted solution]

Bamboo doesn't use Struts REST plugin so it's not affected

[Gonchik Tsymzhitov]

@Alexey Chystoprudov

Thanks for your answer : )

[Brian Hecko]

Thanks for the reply and info, much appreciated.

[Gonchik Tsymzhitov · Accepted solution]

Hi @Brian Hecko

As I read from here . CVE related DoS attacks from XStream library for version < 2.5.16

Have you checked on latest version of the Bamboo

https://confluence.atlassian.com/bamboo/bamboo-6-7-release-notes-959795979.html ?

As I see latest version should not be affected, because Atlassian upgraded to 2.5.17 Struts

Reference:

https://jira.atlassian.com/browse/BAM-20051

Cheers,

Gonchik Tsymzhitov

[Brian Hecko]

Ah, will look into upgrading to 6.7 soon.  Just finished upgrading to 6.6.3 recently.