Security Bulletin - March 19 2024

セキュリティ アドバイザリーおよびセキュリティ情報

このページの内容

関連コンテンツ

  • 関連コンテンツがありません

お困りですか?

アトラシアン コミュニティをご利用ください。

コミュニティに質問

March 2024 Security Bulletin

This bulletin addresses vulnerabilities that have been resolved in Atlassian self-managed products. Cloud products are not affected.

The vulnerabilities reported in this Security Bulletin include 24 high-severity vulnerabilities and 1 critical-severity vulnerability which have been fixed in new versions of our products, released in the last month. These vulnerabilities are discovered via our Bug Bounty program, pen-testing processes, and third-party library scans. 

To fix all the vulnerabilities impacting your product(s), Atlassian recommends patching your instances to the latest version or one of the Fixed Versions for each product below. The listed Fixed Versions for each product are current as of March 19, 2024 (date of publication); visit the linked product Release Notes for the most up-to-date versions. 

NOTE: The vulnerabilities included in monthly Security Bulletins present a lower impact than those published via Critical Security Advisories. Customers can expect to receive those high-priority patches outside of our monthly schedule as necessary. 

To search for CVEs or check your product versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

tip/resting Created with Sketch.

Read more about our March bulletin updates and provide feedback on our Community Post here.

リリースされたセキュリティ脆弱性
Product & Release Notes影響を受けるバージョン修正済みバージョンVulnerability SummaryCVE IDCVSS Severity
Bamboo Data Center and Server
  • 9.5.0 から 9.5.1
  • 9.4.0 から 9.4.3
  • 9.3.0 から 9.3.6
  • 9.2.0 to 9.2.11 (LTS)
  • 9.1.0 から 9.1.3
  • 9.0.0 から 9.0.4
  • 8.2.0 から 8.2.9
  • Any earlier versions
  • 9.6.0 (LTS) or 9.5.2 recommended Data Center Only
  • 9.4.4
  • 9.2.12 (LTS)

SQLi (SQL Injection) org.postgresql:postgresql Dependency in Bamboo Data Center and Server


NOTE: CVE-2024-1597 is a critical vulnerability in a non-Atlassian Bamboo dependency. However, Atlassian’s application of the dependency presents a lower assessed risk, which is why we are disclosing this vulnerability in our monthly Security Bulletin instead of a Critical Security Advisory. 

CVE-2024-1597

10.0 Critical
DoS (Denial of Service) software.amazon.ion:ion-java Dependency in Bamboo Data Center and ServerCVE-2024-216347.5 High
Bitbucket Data Center および Server
  • 8.18.0
  • 8.17.0 から 8.17.1
  • 8.16.0 to 8.16.2
  • 8.15.0 to 8.15.3
  • 8.14.0 to 8.14.4
  • 8.13.0 to 8.13.5
  • 8.12.0 to 8.12.3
  • 8.11.0 to 8.11.1
  • 8.10.0 to 8.10.1
  • 8.9.0 to 8.9.9 (LTS)
  • Any earlier versions (except 7.21.22)
  • 8.19.0 (LTS) recommended Data Center Only
  • 8.18.1
  • 8.17.2
  • 8.16.3 から 8.16.4
  • 8.15.4 から 8.15.5
  • 8.14.5 から 8.14.6
  • 8.13.6
  • 8.9.10 to 8.9.11 (LTS)
  • 7.21.22 から 7.21.23
DoS (Denial of Service) software.amazon.ion:ion-java Dependency in Bitbucket Data Center and ServerCVE-2024-216347.5 High
Confluence Data Center および Server
  • 8.8.0

  • 8.7.0 から 8.7.2

  • 8.6.0 から 8.6.2

  • 8.5.0 to 8.5.6 (LTS)

  • 8.4.0 から 8.4.5

  • 8.3.0 から 8.3.4

  • 8.2.0 から 8.2.3

  • 8.1.0 から 8.1.4

  • 8.0.0 から 8.0.4

  • 7.20.0 から 7.20.3

  • 7.19.0 (LTS) to 7.19.19 (LTS)

  • 7.18.0 から 7.18.3

  • 7.17.0 から 7.17.5

  • Any earlier versions

  • 8.8.1 recommended Data Center Only

  • 8.5.7 (LTS)

  • 7.19.20 (LTS)

Path Traversal in Confluence Data CenterCVE-2024-216778.3 High
DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Confluence Data Center and ServerCVE-2023-364787.5 High
Jira Software Data Center および Server
  • 9.12.0 to 9.12.2 LTS
  • 9.11.0 から 9.11.3
  • 9.10.0 から 9.10.2
  • 9.9.0 から 9.9.2
  • 9.8.0 から 9.8.2
  • 9.7.0 から 9.7.2
  • 9.6.0
  • 9.5.0 から 9.5.1
  • 9.4.0 to 9.4.17 LTS
  • 9.3.0 から 9.3.3
  • 9.2.0 から 9.2.1
  • 9.1.0 から 9.1.1
  • 9.0.0
  • Any earlier versions

















  • 9.14.1 recommended or 9.14.0 Data Center Only
  • 9.12.5 (LTS)
  • 9.4.18 (LTS)















DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and ServerCVE-2022-401507.5 High
DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Jira Software Data Center and ServerCVE-2023-344557.5 High
RCE (Remote Code Execution) org.apache.xmlgraphics:batik-script Dependency in Jira Software Data Center and ServerCVE-2022-428907.5 High
RCE (Remote Code Execution) org.apache.xmlgraphics:batik-bridge Dependency in Jira Software Data Center and ServerCVE-2022-417047.5 High
SSRF (Server-Side Request Forgery) org.apache.xmlgraphics:batik-bridge Dependency in Jira Software Data Center and ServerCVE-2022-401467.5 High
DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and ServerCVE-2023-14367.5 High
DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and ServerCVE-2022-456857.5 High
DoS (Denial of Service) net.sourceforge.nekohtml:nekohtml Dependency in Jira Software Data Center and ServerCVE-2022-295467.5 High
DoS (Denial of Service) org.codehaus.jettison:jettison Dependency in Jira Software Data Center and ServerCVE-2022-401497.5 High
DoS (Denial of Service) org.apache.avro:avro Dependency in Jira Software Data Center and ServerCVE-2023-394107.5 High
DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Jira Software Data Center and ServerCVE-2023-344547.5 High
DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Jira Software Data Center and ServerCVE-2023-344537.5 High
DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Jira Software Data Center and ServerCVE-2023-436427.5 High
DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency in Jira Software Data Center and ServerCVE-2022-35097.5 High
DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency in Jira Software Data Center and ServerCVE-2022-31717.5 High
DoS (Denial of Service) org.json:json Dependency in Jira Software Data Center and ServerCVE-2023-50727.5 High
DoS (Denial of Service) org.json:json Dependency in Jira Software Data Center and ServerCVE-2022-456887.5 High
RCE (Remote Code Execution) xalan:xalan Dependency in Jira Software Data Center and ServerCVE-2022-341697.5 High
DoS (Denial of Service) net.sourceforge.nekohtml:nekohtml Dependency in Jira Software Data Center and ServerCVE-2022-248397.5 High
DoS (Denial of Service) net.sourceforge.nekohtml:nekohtml Dependency in Jira Software Data Center and ServerCVE-2022-283667.5 High


Frequently Asked Questions:

  • Why is my Feature Version not listed in a Fixed Version? You may be using an unsupported version and need to patch to the latest version or Long-Term Support (LTS) version.

  • What are the most up-to-date Data Center product versions? You can always check the software download portal or visit the product-specific download pages.

  • I am using an LTS, why is it not listed in the Fixed Versions? Your LTS version may not have been updated yet or a backported fix may not have been feasible. Please see our Security Bug Fix Policy for more information. We recommend upgrading your products to the latest versions. For the latest fixed versions, visit the release notes linked in the vulnerability table. 

  • Questions about the bulletin, have feedback? Let us know! Read more about our bulletins and feel free to contribute feedback on our latest Community Post


To search for CVEs or check your products versions for disclosed vulnerabilities, check the Vulnerability Disclosure Portal.

Last modified on Mar 21, 2024

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する

関連コンテンツ

  • 関連コンテンツがありません
Powered by Confluence and Scroll Viewport.