This is a public space:
For the draft, please restrict the page during creation and
remove this warning when page is published
Contents
| Date |
|
|---|---|
| Product |
|
| Vulnerability | Critical |
| CVE | |
| Official link | https://confluence.atlassian.com/x/j--qRg |
Git Buffer Overflow in Multiple Products - CVE-2022-41903, CVE-2022-23521
Dear customer,
This advisory addresses a pair of critical security vulnerabilities in Git that affect multiple Atlassian products.
Atlassian Cloud sites are not affected.
CVE-2022-41903 - Heap overflow in git archive, git log --format
Git Security Advisory - CVE-2022-41903
git log has the ability to display commits using an arbitrary format with its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute.
When processing the padding operators for formatting (e.g., %<(, %<|(, %>(, >>(, or %><(), an integer overflow can occur. This overflow can be triggered directly by a user running a command that invokes the commit formatting machinery, or indirectly through git archive and the export-subst mechanism.
The integer overflow results in arbitrary heap writes, which may result in remote code execution.
CVE-2022-23531 - gitattributes parsing integer overflow
Git Security Advisory - CVE-2022-23521
gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern.
When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted .gitattributes file that may be part of the commit history.
This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution.
Affected Products
Git has released patches for both vulnerabilities for versions >= v2.30.7
Bitbucket Server and Data Center
Affected Versions
All versions of Bitbucket Server and Bitbucket Data Center are affected.
Patch Recommendations
Git Configuration | Recommendation |
|---|---|
For customers providing Git themselves | Atlassian recommends customers upgrade to the latest patched and supported version of Git available. Please refer to the supported platforms page for a particular version of Bitbucket to find if it supports Git v2.30.7+. Customers using versions of Bitbucket Server and Data Center < 7.9 will need to upgrade Bitbucket to a later version to support a patched version of Git. However, for customers running Bitbucket 7.6, the Bitbucket Team has tested and confirmed that Git v2.30.7 should work. |
For customers using a Bitbucket Docker Image | All images in the support lifecycle for Bitbucket have been updated to use a patched version of Git. Please re-download the images to pull the latest changes. Similarly, customers that pin a Bitbucket image to a hash need to update to the latest hash version associated with the respective image tag. |
For customers using Git for Windows | The Bitbucket team has released version v7.21.9, which adds support for Git v2.39.x. Please update to the latest patched and supported version of Git available. Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities. |
Bamboo Server and Data Center
Affected Versions
All versions of Bamboo are affected.
Patch Recommendations
Git Configuration | Recommendation |
|---|---|
For customers providing Git themselves | Atlassian recommends customers update Git at the Bamboo server and remote agents to the latest patched and supported version available. Please refer to the supported platforms page for a particular version of Bamboo to see if it supports Git v2.30.7+ |
For customers using a Bamboo Docker Image | All images in the support lifecycle have been updated to use a patched version of Git. Please re-download the images to pull the latest changes. Similarly, customers that pin a Bamboo image to a hash need to update to the latest hash version associated with the respective image tag. |
For customers using Elastic Bamboo | New AMIs have been prepared with a patched Git Version for Linux and Windows in supported regions in the upcoming Bamboo 9.1.3 release. Customers not wanting to wait for the release can add a line to update Git in the image startup script at the existing image configuration screen or download and use the AMIs before the official release.. |
For customers using Git for Windows | Please update to the latest version of Git for Windows Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities. |
Fisheye Server
Affected Versions
All versions of Fisheye are affected.
Patch Recommendations
Git Configuration | Recommendation |
|---|---|
For customers providing Git themselves | Atlassian recommends customers upgrade to the latest patched and supported version of Git available. Please refer to the supported platforms page for a particular version of Fisheye to see if it supports Git v2.30.7+ |
For customers using a Fisheye Docker Image | All images in the support lifecycle have been updated to use a patched version of Git. Please re-download the images to pull the latest changes. Similarly, customers that pin a Fisheye image to a hash need to update to the latest hash version associated with the respective image tag. |
For customers using Git for Windows | Please update to the latest version of Git for Windows Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities. |
Crucible Server
Affected Versions
All versions of Crucible are affected
Patch Recommendations
Git Configuration | Recommendation |
|---|---|
For customers providing Git themselves | Atlassian recommends customers upgrade to the latest patched and supported version of Git available. Please refer to the supported platforms page for a particular version of Fisheye to see if it supports Git v2.30.7+ |
For customers using a Crucible Docker Image | All images in the support lifecycle have been updated to use a patched version of Git. Please re-download the images to pull the latest changes. Similarly, customers that pin a Crucible image to a hash need to update to the latest hash version associated with the respective image tag. |
For customers using Git for Windows | Please update to the latest version of Git for Windows Currently, Git for Windows does not have plans to backport fixes for these vulnerabilities. |
Sourcetree
Affected Versions
All versions of Sourcetree for Mac and Windows are vulnerable.
Fixed Versions
The Sourcetree team is actively working on updating embedded Git binaries to v2.39.1 for the next product release version.
Mac: v4.2.2
Windows: v3.4.12
Mitigation
While the Sourcetree team is working on updating the embedded Git binary, we recommend customers switch Sourcetree to use a patched system Git version.
