We couldn't load all Actvitity tabs. Refresh the page to try again.
If the problem persists, contact your Jira admin.
IMPORTANT: JAC is a Public system and anyone on the internet will be able to view the data in the created JAC tickets. Please don’t include Customer or Sensitive data in the JAC ticket.
Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-14528

RCE (Remote Code Execution) in Bitbucket Data Center and Server - CVE-2022-1471

    • 9.8
    • Critical
    • CVE-2022-1471
    • Atlassian (Internal)
    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • RCE (Remote Code Execution)
    • Bitbucket Data Center, Bitbucket Server

      Summary of Vulnerability

      Multiple Atlassian Data Center and Server Products use the SnakeYAML library for Java, which is susceptible to a deserialization flaw that can lead to RCE (Remote Code Execution).

       
       Atlassian Cloud sites are not affected by this vulnerability. If your site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

      Affected Versions

      Product Affected Versions
      Bitbucket Data Center
      Bitbucket Server
      • 7.17.x
      • 7.18.x
      • 7.19.x
      • 7.20.x
      • 7.21.0
      • 7.21.1
      • 7.21.2
      • 7.21.3
      • 7.21.4
      • 7.21.5
      • 7.21.6
      • 7.21.7
      • 7.21.8
      • 7.21.9
      • 7.21.10
      • 7.21.11
      • 7.21.12
      • 7.21.13
      • 7.21.14
      • 7.21.15
      • 8.0.x
      • 8.1.x
      • 8.2.x
      • 8.3.x
      • 8.4.x
      • 8.5.x
      • 8.6.x
      • 8.7.x
      • 8.8.0
      • 8.8.1
      • 8.8.2
      • 8.8.3
      • 8.8.4
      • 8.8.5
      • 8.8.6
      • 8.9.0
      • 8.9.1
      • 8.9.2
      • 8.9.3
      • 8.10.0
      • 8.10.1
      • 8.10.2
      • 8.10.3
      • 8.11.0
      • 8.11.1
      • 8.11.2
      • 8.12.0

      Fixed Versions

      Product Fixed Versions
      Bitbucket Data Center
      Bitbucket Server
      Patch to the following fixed versions or later
      • 7.21.16 (LTS)
      • 8.8.7 
      • 8.9.4 (LTS)
      • 8.10.4 
      • 8.11.3 
      • 8.12.1 
      • 8.13.0 
      • 8.14.0
      • 8.15.0 (Data Center Only)
      • 8.16.0 (Data Center Only)

      What You Need to Do

      Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” table section of this ticket. For full descriptions of the above versions of Bitbucket Data Center and Server, see the release notes. You can download the latest version of Bitbucket Data Center and Server from the download center.

       

      For additional details, please see the full advisory.

            Loading...
            IMPORTANT: JAC is a Public system and anyone on the internet will be able to view the data in the created JAC tickets. Please don’t include Customer or Sensitive data in the JAC ticket.
            Uploaded image for project: 'Bitbucket Data Center'
            1. Bitbucket Data Center
            2. BSERV-14528

            RCE (Remote Code Execution) in Bitbucket Data Center and Server - CVE-2022-1471

              • 9.8
              • Critical
              • CVE-2022-1471
              • Atlassian (Internal)
              • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
              • RCE (Remote Code Execution)
              • Bitbucket Data Center, Bitbucket Server

                Summary of Vulnerability

                Multiple Atlassian Data Center and Server Products use the SnakeYAML library for Java, which is susceptible to a deserialization flaw that can lead to RCE (Remote Code Execution).

                 
                 Atlassian Cloud sites are not affected by this vulnerability. If your site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

                Affected Versions

                Product Affected Versions
                Bitbucket Data Center
                Bitbucket Server
                • 7.17.x
                • 7.18.x
                • 7.19.x
                • 7.20.x
                • 7.21.0
                • 7.21.1
                • 7.21.2
                • 7.21.3
                • 7.21.4
                • 7.21.5
                • 7.21.6
                • 7.21.7
                • 7.21.8
                • 7.21.9
                • 7.21.10
                • 7.21.11
                • 7.21.12
                • 7.21.13
                • 7.21.14
                • 7.21.15
                • 8.0.x
                • 8.1.x
                • 8.2.x
                • 8.3.x
                • 8.4.x
                • 8.5.x
                • 8.6.x
                • 8.7.x
                • 8.8.0
                • 8.8.1
                • 8.8.2
                • 8.8.3
                • 8.8.4
                • 8.8.5
                • 8.8.6
                • 8.9.0
                • 8.9.1
                • 8.9.2
                • 8.9.3
                • 8.10.0
                • 8.10.1
                • 8.10.2
                • 8.10.3
                • 8.11.0
                • 8.11.1
                • 8.11.2
                • 8.12.0

                Fixed Versions

                Product Fixed Versions
                Bitbucket Data Center
                Bitbucket Server
                Patch to the following fixed versions or later
                • 7.21.16 (LTS)
                • 8.8.7 
                • 8.9.4 (LTS)
                • 8.10.4 
                • 8.11.3 
                • 8.12.1 
                • 8.13.0 
                • 8.14.0
                • 8.15.0 (Data Center Only)
                • 8.16.0 (Data Center Only)

                What You Need to Do

                Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” table section of this ticket. For full descriptions of the above versions of Bitbucket Data Center and Server, see the release notes. You can download the latest version of Bitbucket Data Center and Server from the download center.

                 

                For additional details, please see the full advisory.

                        Unassigned Unassigned
                        security-metrics-bot Security Metrics Bot
                        Votes:
                        0 Vote for this issue
                        Watchers:
                        5 Start watching this issue

                          Created:
                          Updated:
                          Resolved:

                            Unassigned Unassigned
                            security-metrics-bot Security Metrics Bot
                            Votes:
                            0 Vote for this issue
                            Watchers:
                            5 Start watching this issue

                              Created:
                              Updated:
                              Resolved: