Description and Immediate Mitigation Steps

Vulnerability Information:

• • Severity: The critical vulnerability in Bitbucket Data Center, Bitbucket Server is classified as “High.”
  • Versions Impacted: 9.2.1, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7
  • CVE Identifier: The specific vulnerability is tracked as CVE-2020-26217
  • CVSS Score: Atlassian assigned a  CVSS score of 8.8 to this vulnerability, highlighting its severity. This score is due to the ability for unauthenticated attacker to expose assets in your environment susceptible to exploitation. 
  • Vulnerability Description: This vulnerability could allow a remote attacker to execute arbitrary shell commands by manipulating the processed input stream. It affects users who rely on blocklists but does not impact those using XStream’s Security Framework allowlist. Code workarounds are provided in the linked advisory for users who cannot upgrade. The issue has been fixed in version 1.4.14.
  • The vulnerability in XStream (versions before 1.4.14) is described as a Remote Code Execution issue that allows remote attackers to run arbitrary shell commands by manipulating the input stream. Users relying on blocklists are affected, while those using XStream’s Security Framework allowlist are not affected.

Affected Versions:

• • Introduced in version 9.2.1 of Bamboo Data Center and Server.

Recommended Actions:

• • Bamboo Data Center and Server customers should upgrade to the latest version.
  • If unable to upgrade to the latest version, upgrade your instance to one of the specified supported fixed versions based on your current version:
    • For Bamboo Data Center and Server 9.2, upgrade to a release greater than or equal to 9.2.8.

Standard Manual Upgrade Steps:

• • Notify users of outage for critical hotfixing
  • Stop services across all nodes
  • Backup existing database and shared home prior to upgrade
  • Make copies of the setenv.sh and server.xml found in the application install directories bin & conf (these hold critical settings we want to propogate again post upgrade
  • Download the hotfix from the Atlassian archives
  • Apply the upgrade, do not auto-start services
  • Copy back the setenv.sh, server.xml, and any other customized files you had to copy during the upgrade process
  • Restart services and perform smoke testing once Confluence is available

Conclusion:

Here is the notice from the National Vulnerability Database

Link to Atlassian ticket can be found here. 

Thanks for visiting, click here to learn more about out our Atlassian Cloud Services!