Is Bamboo server 7.2.4 affected by Tomcat vulnerability CVE-2022-25762

[niraj]

Hello,

Is Bamboo server 7.2.4 affected by Tomcat vulnerability CVE-2022-25762?

Do I have to upgrade my bamboo version?

Thanks

[Eduardo Alvarenga · Accepted solution]

Hello @niraj,

Welcome to Atlassian Community!

Short Answer: Not vulnerable

CVE-2022-25762 does not affect Bamboo as Bamboo does not use Web sockets.

Customers are free to manually update Bamboo’s embedded Tomcat to version 8.5.76 or later as instructed on this page:

• How to upgrade Apache Tomcat version used by Bamboo | Bamboo | Atlassian Documentation

Sincerely,

Eduardo Alvarenga
Atlassian Support APAC

--please don't forget to Accept the answer if the reply is helpful-- 

[niraj]

Thanks for the Reply Eduardo,

But my Bamboo instance is publically accessible, and the tomcat version 8.5.64 is vulnerable.

So do I have to upgrade Tomcat because of this vulnerability?

Or we are safe even if the tomcat version is vulnerable?

Can you please also clarify this part? Our security team is asking us to upgrade the tomcat because of this vulnerability.

Thanks,

Niraj

[Eduardo Alvarenga]

Hello @niraj

It is highly recommended that you upgrade Bamboo to at least 8.2.5 due to the following vulnerabilities (not only Tomcat)!

• BAM-21588: log4j dependency is exposure to CVE-2021-4104 (fixed in Bamboo 8.1.2, 8.0.6, 8.2.0)
• BAM-21834: Bamboo Struts security vulnerability CVE-2021-31805 (fixed in Bamboo 8.0.7, 8.2.2, 8.1.6, 7.2.10)
• FAQ for CVE-2022-22965
• BAM-21755: Update Spring to 5.3.18+ to mitigate CVE-2022-22965 (fixed in Bamboo 8.0.7, 8.2.2, 8.1.6)
• BAM-21769: Upgrade Tomcat to mitigate CVE-2022-29885 (fixed in Bamboo 8.0.10, 8.1.9, 8.2.5)
• FAQ for CVE-2022-26136 / CVE-2022-26137

By default, the primary technical contact for a Support Entitlement Number (SEN) will always receive emails regarding security vulnerabilities as well as other technical alerts (pricing changes, maintenance notifications, etc). Make sure to keep the technical contact updated for the referring Support Entitlement Number:

• How do I update the billing and technical contacts for my Atlassian products?

If you prefer having a more directed approach, you can subscribe your account to our Security Advisories mailing list. To ensure you are on this list, please update your email preferences at https://my.atlassian.com/email under "Tech Alerts".

You can find more information on how we deal with Security Advisories here:

• Security Advisory Publishing Policy - Atlassian

We recommend you renew your Bamboo subscription, install the updated License string and plan your Bamboo upgrade.

Kind regards,

Eduardo Alvarenga
Atlassian Support APAC

--please don't forget to Accept the answer if the reply is helpful-- 

[niraj]

Thanks Eduardo for clarifying.