You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
Next: Root
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
Bamboo appears to use a custom version of the struts2-core-2.5.13 jar. Is Bamboo therefore vulnerable to the above CVE?
Additionally, on what timescale can we expect a new release of Bamboo that uses the latest fixed version of Struts (2.5.17)?
Bamboo is not vulnerable.
Struts 2.5.17 will be part of Bamboo 6.7 release planned for second half of September 2018
Hi @Richard Cross,
in another post, Atlassian replied the following:
----
Thank you for reaching out to Atlassian Community!
We understand your concern regarding the new CVE-2018-11776 vulnerability announced On August 22, by the Apache Software Foundation
Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL.
However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of Crowd 3.2.x and 3.1.x with updated version of Struts.
Let me know if this helps,
--Alexis
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.