Bitbucket Data Center Security Advisory 2019-05-22
Bitbucket Data Center - Path traversal in the migration tool RCE - CVE-2019-3397
| 要約 | CVE-2019-3397 - Path traversal in the migration tool |
|---|---|
| 勧告のリリース日 | 22 May 2019, 10:00 AM PDT (Pacific Time, -7 hours) |
| 製品 | Bitbucket Data Center (Note: Bitbucket Server without a Data Center license is unaffected) |
Bitbucket Data Center の影響を受けるバージョン |
|
Fixed Bitbucket Data Center Versions |
|
| CVE ID | CVE-2019-3397 |
脆弱性の概要
This advisory discloses a critical severity security vulnerability which was introduced in version 5.13.0 of Bitbucket Data Center. Versions of Bitbucket Data Center starting with 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x), from 5.15.0 before 5.15.3 (fixed version for 5.15.x), from 5.16.0 before 5.16.3 (fixed version for 5.16.x), from 6.0.0 before 6.0.3 (fixed version for 6.0.x), and from 6.1.0 before 6.1.2 (the fixed version for 6.1.x) are affected by this vulnerability.
Customers who have upgraded Bitbucket Data Center to version 5.13.6, 5.14.4, 5.15.3, 5.16.3, 6.0.3 or 6.1.2 are not affected.
Customers who have downloaded and installed:
- Bitbucket Data Center >= 5.13.0 less than 5.13.6 (the fixed version for 5.13.0)
- Bitbucket Data Center >= 5.14.0 less than 5.14.4 (the fixed version for 5.14.0)
- Bitbucket Data Center >= 5.15.0 less than 5.15.3 (the fixed version for 5.15.0)
- Bitbucket Data Center >= 5.16.0 less than 5.16.3 (the fixed version for 5.16.0)
- Bitbucket Data Center >= 6.0.0 less than 6.0.3 (the fixed version for 6.0.0)
- Bitbucket Data Center >= 6.1.0 less than 6.1.2 (the fixed version for 6.1.0)
Please upgrade your Bitbucket Data Center installations immediately to fix this vulnerability.
Path traversal in the migration tool - CVE-2019-3397
深刻度
アトラシアンはアトラシアンの深刻度レベルで公開されているスケールに従って、この脆弱性の深刻度レベルを重大として評価しています。このスケールによって、深刻度を重大、高度、中度、低度として評価できます。
これはアトラシアンの評価であり、お客様自身の IT 環境への適用性を評価する必要があります。
説明
Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Bitbucket Data Center. Bitbucket Server versions without a Data Center license are not vulnerable to this vulnerability.
この問題はこちらで追跡されています。 BSERV-11706 - Getting issue details... STATUS
謝辞
Credit for finding this vulnerability goes to Johannes Moritz from RIPS Technologies (https://www.ripstech.com/research/)
修正
弊社ではこの問題に対応するために次の対応を行いました。
- Released Bitbucket Data Center version 6.1.2 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download/data-center
- Released Bitbucket Data Center version 6.0.3 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives
- Released Bitbucket Data Center version 5.16.3 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives
- Released Bitbucket Data Center version 5.15.3 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives
- Released Bitbucket Data Center version 5.14.4 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives
- Released Bitbucket Data Center version 5.13.6 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives
必要なアクション
Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Bitbucket Data Center, see the release notes. You can download the latest version of Bitbucket Data Center from the download centre.
Upgrade Bitbucket Data Center to version 6.1.2 or higher.
If you are running Bitbucket Data Center 5.13.x and cannot upgrade to 6.1.2 then upgrade to version 5.13.6.
If you are running Bitbucket Data Center 5.14.x and cannot upgrade to 6.1.2 then upgrade to version 5.14.4.
If you are running Bitbucket Data Center 5.15.x and cannot upgrade to 6.1.2 then upgrade to version 5.15.3.
If you are running Bitbucket Data Center 5.16.x and cannot upgrade to 6.1.2 then upgrade to version 5.16.3.
If you are running Bitbucket Data Center 6.0.x and cannot upgrade to 6.1.2 then upgrade to version 6.0.3.
問題の軽減策
The import functionality can be disabled via a feature flag, which would mitigate this vulnerability. This can be done by setting the property feature.data.center.migration.import=false in bitbucket.properties. Note that the export functionality would still work in this case. Bitbucket Server must then be restarted for changes to become effective.
If an import task still needs to be run, enable the feature on an isolated cluster node (inaccessible by users and admins but still connected to the cluster and accessible by sysadmins) with a node-local bitbucket.properties file where the property feature.data.center.migration.import=true is set. Imports can then be started by talking to this node directly while it would still be disabled on other nodes.
サポート
このアドバイザリのメールを受信していないため今後の受信を希望する場合は、https://my.atlassian.com/email にアクセスしてアラート メールにご登録ください。
この勧告に関してご質問や懸念がある場合は、https://support.atlassian.com/ja/ でサポート リクエストを作成してください。
参考
| セキュリティ バグの修正ポリシー | As per our new policy critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. We will release new maintenance releases for the versions covered by the policy instead of binary patches. バイナリ パッチのリリースは終了しています。 |
| セキュリティの問題の重大度レベル | アトラシアンのセキュリティ勧告には重大度レベルと CVE ID が含まれます。重大度レベルは、それぞれの脆弱性についてアトラシアンが独自に計算した CVSS スコアに基づきます。CVSS は業界標準の脆弱性メトリックです。CVSS の詳細を FIRST.org でご確認ください。 |
| サポート終了ポリシー | サポート終了ポリシーは、製品によって異なります。詳細は、アトラシアンの「製品終了ポリシー」を参照してください。 |