Bitbucket Server security advisory 2018-03-21
Bitbucket Server - Remote Code Execution via in Browser Editing - CVE-2018-5225
Note: As of September 2014 we are no longer issuing binary bug patches, instead we create new bug fix releases for the platform and feature versions we are backporting.
| 要約 | CVE-2018-5225 - Bitbucket Server - Remote Code Execution via in Browser Editing |
|---|---|
| 勧告のリリース日 | 10 AM PDT (Pacific Time, -7 hours) |
| 製品 | Bitbucket Server |
Affected Bitbucket Server Versions |
|
Fixed Bitbucket Server Versions |
|
| CVE ID | CVE-2018-5225 |
脆弱性の概要
This advisory discloses a critical severity security vulnerability which was introduced in version 4.13.0 of Bitbucket Server. All versions of Bitbucket Server before 5.4.8 (the fixed version for 4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x) are affected by this vulnerability. Bitbucket Server 5.9.0 is not impacted by this vulnerability.
Customers who have upgraded Bitbucket Server to version 5.4.8, 5.5.8, 5.6.5, 5.7.3, 5.8.2 or 5.9.0 are not affected.
Customers who have downloaded and installed Bitbucket Server >= 4.13.0 less than 5.4.8 (the fixed version for 4.13.0 through to 5.4.7)
Customers who have downloaded and installed Bitbucket Server >= 5.5.0 less than 5.5.8 (the fixed version for 5.5.x)
Customers who have downloaded and installed Bitbucket Server >= 5.6.0 less than 5.6.5 (the fixed version for 5.6.x)
Customers who have downloaded and installed Bitbucket Server >= 5.7.0 less than 5.7.3 (the fixed version for 5.7.x)
Customers who have downloaded and installed Bitbucket Server >= 5.8.0 less than 5.8.2 (the fixed version for 5.8.x)
Please upgrade your Bitbucket Server installations immediately to fix this vulnerability.
Remote Code Execution via In Browser Editing
深刻度
アトラシアンはアトラシアンの深刻度レベルで公開されているスケールに従って、この脆弱性の深刻度レベルを重大として評価しています。このスケールによって、深刻度を重大、高度、中度、低度として評価できます。
これはアトラシアンの評価であり、お客様自身の IT 環境への適用性を評価する必要があります。
説明
An authenticated user of Bitbucket Server could gain remote code execution using the in-browser editing feature via editing a symbolic link within a repository.
All versions of Bitbucket Server before 5.4.8 (the fixed version for 4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x) are affected by this vulnerability. Bitbucket Server 5.9.0 is not impacted by this vulnerability. This issue can be tracked here: https://jira.atlassian.com/browse/BSERV-10684
修正
弊社ではこの問題に対応するために次の対応を行いました。
- Released Bitbucket Server version 5.9.0 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download.
- Released Bitbucket Server version 5.8.2 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
- Released Bitbucket Server version 5.7.3 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
- Released Bitbucket Server version 5.6.5 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
- Released Bitbucket Server version 5.5.8 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
- Released Bitbucket Server version 5.4.8 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
必要なアクション
Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Bitbucket Server, see the release notes. You can download the latest version of Bitbucket Server from the download centre.
問題の軽減策
If you are running an affected version of Bitbucket Server and cannot upgrade to an unaffected version the following mitigation can be performed:
Set
feature.file.editor=falsein the bitbucket.properties file- Restart Bitbucket Server for changes to become effective
Please note that this mitigation does not mitigate against vulnerabilities where third party plugins use the file editing API programatically.
サポート
If you did not receive an email for this advisory and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to the Alerts emails.
この勧告に関してご質問や懸念がある場合は、https://support.atlassian.com/ja/ でサポート リクエストを作成してください。
参考
| セキュリティ バグの修正ポリシー | As per our new policy critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. We will release new bug fix releases for the versions covered by the new policy instead of binary patches. バイナリ パッチのリリースは終了しています。 |
| セキュリティの問題の重大度レベル | アトラシアンのセキュリティ勧告には重大度レベルと CVE ID が含まれます。重大度レベルは、それぞれの脆弱性についてアトラシアンが独自に計算した CVSS スコアに基づきます。CVSS は業界標準の脆弱性メトリックです。CVSS の詳細を FIRST.org でご確認ください。 |
| サポート終了ポリシー | サポート終了ポリシーは、製品によって異なります。詳細は、アトラシアンの「製品終了ポリシー」を参照してください。 |