Atlassian Bitbucket: Mehrere Schwachstellen ermöglichen Denial of Service

Summary

Product

Vulnerabilities 3

• High 7.5
  CVE-2024-57699

  Netplex Json-smart Uncontrolled Recursion vulnerability

  A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issu…

  trino trino-plugin-opensearch trino-plugin-lakehouse trino-plugin-pinot Debian Ubuntu Wolfi Maven
  Feb 5, 2025
• High 7.5
  CVE-2025-24970

  SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

  Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of suc…

  netty netty druid thingsboard-tb-node Ubuntu Wolfi Maven
  Feb 10, 2025
• High 7.5
  CVE-2025-31650 Public exploit EPSS 61%

  Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

  Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOf…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 28, 2025

Revision history

1. 2025-06-17 #1

   Initiale Fassung

References

• Atlassian Security Bulletin vom 2025-06-17
  https://confluence.atlassian.com/security/security-bulletin-june-17-2025-1574012717.html
• PoC für CVE-2024-57699
  https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699