This is a public space:

For the draft, please restrict the page during creation and
remove this warning when page is published



Contents



Date

 

Product

  • Bitbucket Server and Data Center

  • Bamboo Server and Data Center

  • Fisheye

  • Crucible

  • Sourcetree

VulnerabilityCritical
CVE

CVE-2022-41903
CVE-2022-23521

Official linkhttps://confluence.atlassian.com/x/j--qRg




Git Buffer Overflow in Multiple Products - CVE-2022-41903, CVE-2022-23521


Dear customer,

This advisory addresses a pair of critical security vulnerabilities in Git that affect multiple Atlassian products.

CVE-2022-41903 - Heap overflow in git archive, git log --format

(info) Git Security Advisory - CVE-2022-41903 

git log has the ability to display commits using an arbitrary format with its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute.

When processing the padding operators for formatting (e.g., %<(, %<|(, %>(, >>(, or %><(), an integer overflow can occur. This overflow can be triggered directly by a user running a command that invokes the commit formatting machinery, or indirectly through git archive and the export-subst mechanism.

The integer overflow results in arbitrary heap writes, which may result in remote code execution.

CVE-2022-23531 - gitattributes parsing integer overflow

(info) Git Security Advisory - CVE-2022-23521

gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern.

When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted .gitattributes file that may be part of the commit history.

This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution.

Severity

Atlassian rates the severity level of these vulnerabilities as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

Affected Products

(info) Git has released patches for both vulnerabilities for versions >= v2.30.7

Bitbucket Server and Data Center

Affected Versions

All versions of Bitbucket Server and Bitbucket Data Center are affected.

Patch Recommendations

Git Configuration

Recommendation

For customers providing Git themselves

Atlassian recommends customers upgrade to the latest patched and supported version of Git available.

Please refer to the supported platforms page for a particular version of Bitbucket to find if it supports Git v2.30.7+.

Customers using versions of Bitbucket Server and Data Center < 7.9 will need to upgrade Bitbucket to a later version to support a patched version of Git.

However, for customers running Bitbucket 7.6, the Bitbucket Team has tested and confirmed that Git v2.30.7 should work.

For customers using a Bitbucket Docker Image

All images in the support lifecycle for Bitbucket have been updated to use a patched version of Git.

Please re-download the images to pull the latest changes.

Similarly, customers that pin a Bitbucket image to a hash need to update to the latest hash version associated with the respective image tag.

For customers using Git for Windows

The Bitbucket team has released version v7.21.9, which adds support for Git v2.39.x.

Please update to the latest patched and supported version of Git available.

Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities.

Bamboo Server and Data Center

Affected Versions

All versions of Bamboo are affected.

Patch Recommendations

Git Configuration

Recommendation

For customers providing Git themselves

Atlassian recommends customers update Git at the Bamboo server and remote agents to the latest patched and supported version available.

Please refer to the supported platforms page for a particular version of Bamboo to see if it supports Git v2.30.7+

For customers using a Bamboo Docker Image

All images in the support lifecycle have been updated to use a patched version of Git.

Please re-download the images to pull the latest changes.

Similarly, customers that pin a Bamboo image to a hash need to update to the latest hash version associated with the respective image tag.

For customers using Elastic Bamboo

New AMIs have been prepared with a patched Git Version for Linux and Windows in supported regions in the upcoming Bamboo 9.1.3 release. Customers not wanting to wait for the release can add a line to update Git in the image startup script at the existing image configuration screen or download and use the AMIs before the official release..

For customers using Git for Windows

Please update to the latest version of Git for Windows

Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities.

Fisheye Server

Affected Versions

All versions of Fisheye are affected.

Patch Recommendations

Git Configuration

Recommendation

For customers providing Git themselves

Atlassian recommends customers upgrade to the latest patched and supported version of Git available.

Please refer to the supported platforms page for a particular version of Fisheye to see if it supports Git v2.30.7+

For customers using a Fisheye Docker Image

All images in the support lifecycle have been updated to use a patched version of Git.

Please re-download the images to pull the latest changes.

Similarly, customers that pin a Fisheye image to a hash need to update to the latest hash version associated with the respective image tag.

For customers using Git for Windows

Please update to the latest version of Git for Windows

Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities.

Crucible Server

Affected Versions

All versions of Crucible are affected

Patch Recommendations

Git Configuration

Recommendation

For customers providing Git themselves

Atlassian recommends customers upgrade to the latest patched and supported version of Git available.

Please refer to the supported platforms page for a particular version of Fisheye to see if it supports Git v2.30.7+

For customers using a Crucible Docker Image

All images in the support lifecycle have been updated to use a patched version of Git.

Please re-download the images to pull the latest changes.

Similarly, customers that pin a Crucible image to a hash need to update to the latest hash version associated with the respective image tag.

For customers using Git for Windows

Please update to the latest version of Git for Windows

Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities.

Sourcetree

Affected Versions

All versions of Sourcetree for Mac and Windows are vulnerable.

Fixed Versions

The Sourcetree team is actively working on updating embedded Git binaries to v2.39.1 for the next product release version.

  • Mac: v4.2.2

  • Windows: v3.4.12

Mitigation

While the Sourcetree team is working on updating the embedded Git binary, we recommend customers switch Sourcetree to use a patched system Git version.


if wanted add translations in german or/and french with the according language macro