Create
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Products
See all
Community resources
Interests
See all
Community resources
Top groups
Explore all groups
Community resources
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Join now to unlock these features and more

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Get started Tell me more
Atlassian Community about banner
4,462,888
Community Members
 
Community Events
176
Community Groups

Is Bamboo vulnerable to CVE-2018-11776 (Apache Struts)

Richard Cross
Richard Cross Aug 29, 2018

Bamboo appears to use a custom version of the struts2-core-2.5.13 jar.  Is Bamboo therefore vulnerable to the above CVE?

Additionally, on what timescale can we expect a new release of Bamboo that uses the latest fixed version of Struts (2.5.17)? 

Answer
Watch
Like Be the first to like this
394 views

2 answers

0 votes
Alexey Chystoprudov
Alexey Chystoprudov Atlassian Team Aug 30, 2018

Bamboo is not vulnerable.

Struts 2.5.17 will be part of Bamboo 6.7 release planned for second half of September 2018

Reply
0 votes
Alexis Robert
Alexis Robert Community Leader Aug 29, 2018

Hi @Richard Cross, 

 

in another post, Atlassian replied the following:

 

----

Thank you for reaching out to Atlassian Community!

We understand your concern regarding the new CVE-2018-11776 vulnerability announced On August 22, by the Apache Software Foundation

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL.

However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of Crowd 3.2.x and 3.1.x with updated version of Struts.

 

Let me know if this helps, 

 

--Alexis

Reply

Suggest an answer

Log in or Sign up to answer
Bamboo
Bamboo
TAGS

Atlassian Community Events

See all events