Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-22280

Upgrade Tomcat to fix CVE-2023-28709

XMLWordPrintable

      Issue summary

      Apache Tomcat should be upgraded to 8.5.88 and 9.0.74 or a later version to fix CVE-2023-28709

      Environment

      • Bamboo 8, 9

      Steps to Reproduce

      • Check the Apache Tomcat version on pom.xml or <bamboo-install>/bin/version.sh/bat

      Expected Results

      • Bamboo 8.x: apache-tomcat 8.5.88 and later
      • Bamboo 9.x: apache-tomcat 9.0.74 and later

      Actual Results

      • Bamboo 8.x: apache-tomcat 8.5.87 and earlier
      • Bamboo 9.x: apache-tomcat-9.0.73 and earlier

      Workaround

      At your own risk, you can manually upgrade Tomcat as instructed on this KB:

      WARNING: Unless still reproducible on official releases, Atlassian Support may refuse support requests for Bamboo running over unofficial Tomcat versions.

            [BAM-22280] Upgrade Tomcat to fix CVE-2023-28709

            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 880426 ]
            Cathy S made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 872538 ]
            Eduardo Alvarenga made changes -
            Affects Version/s New: 9.0.2 [ 103491 ]
            Affects Version/s New: 9.1.1 [ 104302 ]
            Affects Version/s New: 9.1.2 [ 104330 ]
            Affects Version/s New: 8.2.8 [ 104331 ]
            Affects Version/s New: 9.0.3 [ 104339 ]
            Affects Version/s New: 9.2.3 [ 104892 ]
            Alexey Chystoprudov made changes -
            Remote Link Original: This issue links to "VULN-1098765 (Atlassian Security Jira)" [ 811413 ] New: This issue links to "VULN-1098765 (ASEC/J)" [ 811413 ]
            Eduardo Alvarenga made changes -
            Link New: This issue resolves BAM-22479 [ BAM-22479 ]
            Eduardo Alvarenga made changes -
            Remote Link New: This issue links to "VULN-1098765 (Atlassian Security Jira)" [ 811413 ]
            Security Metrics Bot made changes -
            Labels Original: CVE-2023-28709 security security-imported New: CVE-2023-28709 resolved-in-vf security security-imported
            Alexey Chystoprudov made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Waiting for Release [ 12075 ] New: Closed [ 6 ]
            SET Analytics Bot made changes -
            Support reference count Original: 6 New: 7
            SET Analytics Bot made changes -
            UIS New: 5

              0ecd005f55dd Krzysztof Podsiadło
              73868399605e Eduardo Alvarenga
              Affected customers:
              2 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: