Sep 22, 2023THNServer Safety / Vulnerability

Atlassian and the Web Techniques Consortium (ISC) have disclosed a number of safety flaws impacting their merchandise that may very well be exploited to realize denial-of-service (DoS) and distant code execution.

The Australian software program providers supplier mentioned that the 4 high-severity flaws have been mounted in new variations shipped final month. This contains –

• CVE-2022-25647 (CVSS rating: 7.5) – A deserialization flaw within the Google Gson package deal impacting Patch Administration in Jira Service Administration Knowledge Heart and Server
• CVE-2023-22512 (CVSS rating: 7.5) – A DoS flaw in Confluence Knowledge Heart and Server
• CVE-2023-22513 (CVSS rating: 8.5) – A RCE flaw in Bitbucket Knowledge Heart and Server
• CVE-2023-28709 (CVSS rating: 7.5) – A DoS flaw in Apache Tomcat server impacting Bamboo Knowledge Heart and Server

The failings have been addressed within the following variations –

• Jira Service Administration Server and Knowledge Heart (variations 4.20.25, 5.4.9, 5.9.2, 5.10.1, 5.11.0, or later)
• Confluence Server and Knowledge Heart (variations 7.19.13, 7.19.14, 8.5.1, 8.6.0, or later)
• Bitbucket Server and Knowledge Heart (variations 8.9.5, 8.10.5, 8.11.4, 8.12.2, 8.13.1, 8.14.0, or later)
• Bamboo Server and Knowledge Heart (variations 9.2.4, 9.3.1, or later)

Two Excessive-Severity Flaws in BIND Fastened

In a associated improvement, ISC has launched fixes for 2 high-severity bugs affecting the Berkeley Web Identify Area (BIND) 9 Area Identify System (DNS) software program suite that would pave the best way for a DoS situation –

• CVE-2023-3341 (CVSS rating: 7.5) – A stack exhaustion flaw in management channel code could trigger named to terminate unexpectedly (mounted in variations 9.16.44, 9.18.19, 9.19.17, 9.16.44-S1, and 9.18.19-S1)
• CVE-2023-4236 (CVSS rating: 7.5) – The named service could terminate unexpectedly underneath excessive DNS-over-TLS question load (mounted in variations 9.18.19 and 9.18.19-S1)

The most recent patches arrive three months after ISC rolled out fixes for 3 different flaws within the software program (CVE-2023-2828, CVE-2023-2829, and CVE-2023-2911, CVSS scores: 7.5) that would end in a DoS situation.