High WID-SEC-2024-3663 5 CVEs

Atlassian Bamboo: Mehrere Schwachstellen

Published Dec 10, 2024 · Updated Dec 10, 2024 · de-DE

Vendor: Atlassian Product: Bamboo Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu erzeugen.

Product

Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.

Vulnerabilities 5

High 8.1

CVE-2024-25710

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Azure Linux Wolfi Maven

Feb 19, 2024
High 7.9

CVE-2022-31159 Public exploit

Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applicatio…

AWS aws-sdk-java com.amazonaws:aws-java-sdk-s3 Maven

Jul 15, 2022
High 7.5

CVE-2023-52428

Denial of Service in Connect2id Nimbus JOSE+JWT

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven

Feb 11, 2024
High 7.5

CVE-2024-24549 Public exploit EPSS 23%

Apache Tomcat: HTTP/2 header handling DoS

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Mar 13, 2024
High 7.5

CVE-2024-30172

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

bouncycastle bouncycastle opensearch-2 gradle-8 Debian Ubuntu Wolfi Maven NuGet

May 9, 2024

Revision history

2024-12-10 #1
Initiale Fassung

References

Atlassian Security Bulletin December 2024 vom 2024-12-10
https://confluence.atlassian.com/security/security-bulletin-december-10-2024-1476624803.html