Atlassian Releases Fixes for Over 2 Dozen Flaws, Including Critical Bamboo Bug

Atlassian has released patches for additional than two dozen security flaws, including a critical bug impacting Bamboo Facts Middle and Server that could be exploited without having requiring consumer conversation.

Tracked as CVE-2024-1597, the vulnerability carries a CVSS rating of 10., indicating utmost severity.

Explained as an SQL injection flaw, it truly is rooted in a dependency identified as org.postgresql:postgresql, as a consequence of which the firm reported it “provides a lessen assessed risk” regardless of the criticality.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“This org.postgresql:postgresql dependency vulnerability […] could enable an unauthenticated attacker to expose property in your natural environment vulnerable to exploitation which has substantial effect to confidentiality, higher impact to integrity, high impact to availability, and involves no person conversation,” Atlassian claimed.

In accordance to a description of the flaw in the NIST’s Countrywide Vulnerability Databases (NVD), “pgjdbc, the PostgreSQL JDBC Driver, permits attacker to inject SQL if using PreferQueryMode=Easy.” The driver versions prior to the types listed underneath are impacted –

• 42.7.2
• 42.6.1
• 42.5.5
• 42.4.4
• 42.3.9, and
• 42.2.28 (also set in 42.2.28.jre7)

“SQL injection is probable when utilizing the non-default link home preferQueryMode=uncomplicated in mix with software code that has a vulnerable SQL that negates a parameter value,” the maintainters stated in an advisory final thirty day period.

“There is no vulnerability in the driver when making use of the default query method. End users that do not override the query mode are not impacted.”

The Atlassian vulnerability is said to have been introduced in the subsequent variations of Bamboo Information Heart and Server –

• 8.2.1
• 9..
• 9.1.
• 9.2.1
• 9.3.
• 9.4., and
• 9.5.

The business also emphasized that Bamboo and other Atlassian Info Center goods are unaffected by CVE-2024-1597 as they do not use the PreferQueryMode=Basic in their SQL databases relationship configurations.

SonarSource security researcher Paul Gerste has been credited with exploring and reporting the flaw. Buyers are recommended to update their circumstances to the most recent edition to protect against any likely threats.

Discovered this post attention-grabbing? Adhere to us on Twitter  and LinkedIn to read through additional exclusive articles we write-up.