• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 7.2.2
• Affects Version/s: 7.2.1
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security

[BAM-21284] Git LFS on Windows vulnerable to remote code execution (CVE-2020-27955)

Eric Franklin (Inactive) made changes - 13/Dec/2023 5:37 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 847570 ]

Eric Franklin (Inactive) made changes - 08/Dec/2023 8:28 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 846154 ]

Jacek Krawczyk (Inactive) made changes - 05/Jan/2023 10:32 AM

Remote Link

Original: This issue links to "Page (Atlassian Documentation)" [ 717054 ]

Jacek Krawczyk (Inactive) made changes - 21/Dec/2022 3:59 PM

Remote Link

New: This issue links to "Page (Atlassian Documentation)" [ 717054 ]

Jacek Krawczyk (Inactive) made changes - 16/Dec/2022 5:16 PM

Remote Link

Original: This issue links to "Page (Atlassian Documentation)" [ 715529 ]

Jacek Krawczyk (Inactive) made changes - 16/Dec/2022 4:26 PM

Remote Link

New: This issue links to "Page (Atlassian Documentation)" [ 715529 ]

Security Metrics Bot made changes - 16/Sep/2021 5:28 AM

CVE ID

New: CVE-2020-27955

David Black made changes - 14/Jul/2021 5:37 AM

Remote Link

New: This issue links to "Page (Atlassian Documentation)" [ 565139 ]

Mitchell Johnson made changes - 07/Apr/2021 6:27 PM

Description

Original: This vulnerability affects certain versions of Atlassian Dev Tools. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.

New: A remote code exeecution vulnerability was recently discovered in Git LFS: https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html Vulnerable git clients that clone a malicious repository are vulnerable to remote code execution. Please determine if Bamboo is vulnerable. If it is definitively determined not to be affected, please close this as a false positive. If it is vulnerable, please work on remediating the issue.

Mitchell Johnson made changes - 07/Apr/2021 4:58 PM

Description	Original: This vulnerability affects certain versions of Atlassian Dev Tools. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.	New: This vulnerability affects certain versions of Atlassian Dev Tools. Please describe the impact of the vulnerability here. No known vulnerability could be read off of the parent.
Security	Original: Atlassian Staff [ 10750 ]

Load more older events