Atlassian on Wednesday announced patches for multiple high-severity vulnerabilities in Bamboo, Bitbucket, Confluence , and Crowd.
See also: Godzilla Fileless Backdoor exploits Atlassian Confluence vulnerability
A total of four bugs were addressed in these products. All four allow attackers to cause denial of service (DoS) conditions, as Atlassian's September 2024 security bulletin reveals.
The company updated its Bamboo Data Center and Server to address CVE-2024-34750, a security flaw in Coyote, a connection component of Apache Tomcat.
" When processing an HTTP/2 stream, Tomcat did not properly handle certain HTTP header cases. This led to incorrect counting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout that allowed connections that should have been closed to remain open , " states a NIST advisory.
The vulnerability can be exploited by unauthenticated attackers to “expose assets in your environment that are vulnerable to exploitation” without requiring user interaction, Atlassian says.
See also: Atlassian Confluence vulnerability used for crypto-mining attacks
Bitbucket Data Center and the server received patches for both the Tomcat Coyote flaw and CVE-2024-32007, an improper input validation bug in the Apache CXF JOSE, which could allow an attacker to cause a DoS condition by specifying a large value for p2c in a token.
Two vulnerabilities were addressed with the latest Confluence Data Center and Server updates, one affecting the Bouncy Castle Java dependency (CVE-2024-29857) and another in Clojure (CVE-2024-22871).
A patch for the Java Bouncy Castle flaw was also included in the latest Crowd Data Center and Server.
According to Atlassian, all security flaws were reported through the bug bounty program. None of these issues affect confidentiality or integrity.
Atlassian does not report any of these issues being actively exploited, but urges users to update installations to the latest version of each application or to a stable release as soon as possible.
See also: Cerber ransomware: New version exploits Atlassian vulnerability
Vulnerabilities are a critical factor in the world of information and systems security. They refer to weaknesses or vulnerabilities in a system, software, or network that an attacker can exploit to gain unauthorized access or cause harm. Identifying and fixing vulnerabilities is an ongoing process for security professionals, as threats are constantly evolving and new vulnerabilities appear regularly. Systematic detection and remediation of vulnerabilities is essential to maintaining the security and integrity of information and systems.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: securityweek
