-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Note: the current version of this advisory can be found at https://confluence.atlassian.com/x/rSGSMQ . CVE ID: * CVE-2016-5229 - Deserialisation in Bamboo. Product: Bamboo Affected Bamboo product versions: 2.3.1 <= version < 5.11.4.1 5.12.0 <= version < 5.12.3.1 Fixed Bamboo product versions: * for 5.11.x, Bamboo 5.11.4.1 has been released with a fix for this issue. * for 5.12.x, Bamboo 5.12.3.1 has been released with a fix for this issue. Summary: This advisory discloses a critical severity security vulnerability which was introduced in version 2.3.1 of Bamboo. Versions of Bamboo starting with 2.3.1 before 5.11.4.1 (the fixed version for 5.11.x) and from 5.12.0 before 5.12.3.1 (the fixed version for 5.12.x) are affected by this vulnerability. Atlassian Cloud instances have already been upgraded to a version of Bamboo which does not have the issue described in this advisory. Customers who have upgraded Bamboo to version 5.11.4.1 or version 5.12.3.1 are not affected. Customers who have downloaded and installed Bamboo >= 2.3.1 less than 5.11.4.1 (the fixed version for 5.11.x) and Customers who have downloaded and installed Bamboo >= 5.12.0 less than 5.12.3.1 (the fixed version for 5.12.x) please upgrade your Bamboo installations immediately to fix this vulnerability. Acknowledgements: We would like to credit Moritz Bechler of AgNO3 for reporting this issue to us. Deserialisation resulting in remote code execution caused by insufficient restriction on permitted deserialised classes (CVE-2016-5229) Severity: Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low. This is an independent assessment and you should evaluate its applicability to your own IT environment. Description: Bamboo had a resource that deserialised input from build agents and did not sufficiently restrict which classes could be deserialised. To exploit this issue, attackers need to have a valid Bamboo agent fingerprint or be able to run code on a Bamboo agent. All versions of Bamboo from 2.3.1 before 5.11.4.1 (the fixed version for 5.11.x) and from 5.12.0 before 5.12.3.1 (the fixed version for 5.12.x) are affected by this vulnerability. This issue can be tracked here: https://jira.atlassian.com/browse/BAM-17736 Mitigation: This issue can be mitigated in Bamboo version 5.10.0 and higher by setting the XStream Serialization setting to "whitelist" which prior to the fix versions detailed in this advisory was not the default. See the Serialization protection methods page (https://confluence.atlassian.com/x/gJOzLw) for information on serialization settings. Fix: We have taken the follow steps to address this issue: * Released Bamboo version 5.12.3.1 that contains fixes for this issue. * Released Bamboo version 5.11.4.1 that contains fixes for this issue. Remediation: Upgrade Bamboo to version 5.12.3.1 or higher. If you are running Bamboo 5.11.x and cannot upgrade to bamboo 5.12.3.1 then upgrade to version 5.11.4.1. If you are running Bamboo 5.10.x or higher and cannot upgrade to 5.11.4.1 or 5.12.3.1 then you can follow following steps to mitigate the issue: 1. Log in to Bamboo as an administrator and go to Bamboo administration > Security > Security settings which is found at /admin/configureSecurity.action for your Bamboo instance, for example http://bamboo-host/bamboo/admin/configureSecurity.action 2. Under the Serialization protection methods section, set the XStream setting to Whitelist. 3. Click Save. 4. Check that XStream is set to Whitelist after reloading the Security Settings page. See the Serialization protection methods page (https://confluence.atlassian.com/x/gJOzLw) for information on serialization settings. For a full description of the latest version of Bamboo, see the release notes found at https://confluence.atlassian.com/display/BAMBOO/Bamboo+releases. You can download the latest version of Bamboo from the download centre found at https://www.atlassian.com/software/bamboo/download. Support: If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/ . - -- David Black / Security Engineer. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJXlrO3AAoJECQgl6K8UnaguiMP/Rri5vOtUQ4V/QC6uCBndguP e9FAUKoQ/sQEF4OkoprtW7/ZbA/vfJKg2/+8ZWvwe2OySUdUBF6SjlaOhiWSZYmh 5n0JDutXCWHyW1luvMvFghRlZQWBQPbckfyN3AKAnIoMtPn7yqJOtsY/LfTg7msj zcTttcR9tEV0icUqEC666POfxVLdbG0EMThUMU8ddXDaavc5/us/gRya0/WOEWzL ZnWz+zcw0iA40jGcqwpgj858+4BRPK/O4rsGJn9RGlvHGUFs6OJflZaslTks2292 hlPHSnJZhxMkCN+jBlAsM1BXXbfW7WlKINucJflDKNcbSXJUIf8cjSbz9JvjqlPa g77tj94Lkx9yuszT9MlwNRXWzSIxn3XyuupSBwtJ8NsYULP3IP9RXBYUfa3p0WHn z+Cxi0ho+ZKssbJQI7lr+kDZQILpO+r7wbKrvh+6FBRFv9T4pDPBAvsD4bb853NR GuUc9YWSwu8BRIoR+6rXK3Wl3Ndh6E4m3HH/oNI4CuH+osZk53maVpgtTU9ZcgcX 77ZtMBdVB1tGD6e63JKlMKQMpMoVWHuvEAt3uYThJekT5J1n2cup22q4BLIHxjYQ uEk8argt1EGNiFOl4hP/lIKEoVItkP9BpT09BSemvrLRqCgMXHxGn9xnRym6hoyv 5BuA6SIa5i0PgeLWzgxS =lu9n -----END PGP SIGNATURE-----