What version of Struts is in on Crowd 3.2

[Edmon Uyan]

There has been vulnerability that is raised for Apache Struts. As I recall, Struts is being used by Crowd. Wonder what version of Struts is in the latest Crowd 3.2?

Thank you.

[Marcin Kempa]

Hi @Edmon Uyan

Thank you for reaching out to Atlassian Community!

We understand your concern regarding the new CVE-2018-11776 vulnerability announced On August 22, by the Apache Software Foundation

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach EOL.

However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of Crowd 3.2.x and 3.1.x with updated version of Struts.

Hope that this answers your question.

Marcin Kempa

[Rob Crowell]

Hey Marcin - you state "no Atlassian products" are affected. Just to be clear, does this also cover HipChat? We are running 2.2.4. Thank you.