Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Is Crowd vulnerable to CVE-2018-11776 (Apache Struts)

Hello, I was wondering if Crowd is vulnerable to this report CVE-2018-11776? I am using Crowd 2.11.1.

The detail report implies that it only affects users of Struts 2.3 to 2.3.34 and 2.5 to 2.5.16 with certain configurations. 

https://nvd.nist.gov/vuln/detail/CVE-2018-11776

https://cwiki.apache.org/confluence/display/WW/S2-057

Thanks for any help,

Byron Douglas

 

 

3 answers

2 accepted

3 votes
Answer accepted

Update... there was another question in this forum related to this. Here is the response from Atlassian:

----

Thank you for reaching out to Atlassian Community!

We understand your concern regarding the new CVE-2018-11776 vulnerability announced On August 22, by the Apache Software Foundation

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL.

However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of Crowd 3.2.x and 3.1.x with updated version of Struts.

 

Hope that this answers your question.

Marcin Kempa

Hello, you stated that none of Atlassian products is affected, does this include Bamboo as well? Thanks.

1 vote
Answer accepted

Yes, struts 2.3.32 is used.

 

You can find the version with 

 find atlassian-crowd/ -name \*struts*.jar

Thank you Marcin for your reply.  You stated, your security team investigated and can confirm all other Crowd versions that did not reach EOL are not affected.  How about version 2.9.7?

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL

We have additional information from our security team to confirm with Atlassian.  There are some

 

Do you know if the Struts implementation is vulnerable, according to the two conditions?

 

Apache Struts implementation are vulnerable to the reported RCE flaw if it meets the following conditions:

·         The alwaysSelectFullNamespace flag is set to true in the Struts configuration.

·         Struts configuration file contains an "action" or "url" tag that does not specify the optional namespace attribute or specifies a wildcard namespace.

 

According to the open source research, even if an application is currently not vulnerable, "an inadvertent change to a Struts configuration file may render the application vulnerable in the future.

Thank you for your support

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Asked in Jira Service Management

JSM June ask me anything (AMA)

Hello Community members! We’re wrapping up the end of JSM June with an Ask Me Anything (AMA) with the Jira Service Management product team. This is your chance to ask all your ITSM questions to o...

229 views 12 14
View question

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you