This High severity MITM (Man-in-the-Middle) vulnerability was introduced in versions 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center.

This MITM (Man-in-the-Middle) vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N allows an unauthenticated attacker to position themselves between two or more networked devices using an MITM (Man-in-the-Middle) / adversary-in-the-middle (AiTM) technique.

Atlassian recommends that Bitbucket Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

• Bitbucket Data Center 9.4: Upgrade to a release greater than or equal to 9.4.8

See the release notes (https://confluence.atlassian.com/bitbucketserver/release-notes). You can download the latest version of Bitbucket Data Center from the download center (https://www.atlassian.com/software/bitbucket/download-archives).

The National Vulnerability Database provides the following description for this vulnerability: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.