Bamboo appears to use a custom version of the struts2-core-2.5.13 jar. Is Bamboo therefore vulnerable to the above CVE?
Additionally, on what timescale can we expect a new release of Bamboo that uses the latest fixed version of Struts (2.5.17)?
Hi @Richard Cross,
in another post, Atlassian replied the following:
Thank you for reaching out to Atlassian Community!
We understand your concern regarding the new CVE-2018-11776 vulnerability announced On August 22, by the Apache Software Foundation
Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL.
However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of Crowd 3.2.x and 3.1.x with updated version of Struts.
Let me know if this helps,
G’day Community! As we gear up to introduce Bamboo Data Center to the world, we wanted to make sure that we shared a bit more about Bamboo, the product. Our team has put together an overview video ...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events