Bitbucket server and CVE-2017-12615 Edited

Please comment on whether or not Bitbucket Server on Windows is affected by CVE-2017-12615 and which versions are and are not affected.

3 answers

1 accepted

This is not an official answer (I'm not Atlassian staff), but based on a quick glance at the CVE report and what versions of Tomcat are included in Bitbucket, I think this only affects Stash 3.11.6 or older.

CVE-2017-12615 appears to only affect systems using Tomcat 7.x.

Bitbucket 4.0 or newer uses Tomcat 8.x according to the End of support announcements for Bitbucket Server page.

1 vote

Probably better asked of Atlassian for an answer than the Community.  Https://support.atlassian.com/contact will get you an official answer (we'd ask you to share it here, for info)

Good suggestion. I will report back

1 vote

Hello @Chris Becker,

@G. Sylvie Davies [bit-booster.com] is right. As mentioned to you in the support ticket you have created, the security team has reviewed the vulnerability and has determined that the vulnerability CVE-2017-12615 affects Tomcat 7.0.0 to 7.0.79, and was fixed in revisions 1804604 and 1804729.

According to the announcement from 10 September 2014 at the End of support announcements for Bitbucket Server page, Atlassian would be including Tomcat 8 libraries from Bitbucket Server 4.0 onwards, so all Bitbucket Server versions before 4.0 are likely affected by this vulnerability and all versions from 4.0 onwards are not.

 

 

Please let me know if you need any further clarifications.

Cheers,
Felipe Kraemer

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Posted Jun 12, 2018 in Bitbucket

Do you use any Atlassian products for your personal projects?

After spinning my wheels trying to get organized enough to write a book for National Novel Writing Month (NaNoWriMo) I took my affinity for Atlassian products from my work life and decided to tr...

23,059 views 26 12
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you