-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

This email refers to the advisory found at
https://confluence.atlassian.com/x/3WNsO


CVE ID: CVE-2018-5225


Products: Bitbucket Server

Affected Bitbucket Server Versions:
4.13.0 <= version < 5.4.8
5.5.0 <= version < 5.5.8
5.6.0 <= version < 5.6.5
5.7.0 <= version < 5.7.3
5.8.0 <= version < 5.8.2

Fixed Bitbucket Server Versions:
5.4.8
5.5.8
5.6.5
5.7.3
5.8.2
5.9.0


Summary:
This advisory discloses a critical severity security vulnerability
which was introduced in version 4.13.0 of Bitbucket Server. All
versions of Bitbucket Server before  5.4.8 (the fixed version for
4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for
5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before
5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed
version for 5.8.x) are affected by this vulnerability. Bitbucket
Server 5.9.0 is not impacted by this vulnerability.


Customers who have upgraded Bitbucket Server to version 5.4.8, 5.5.8,
5.6.5, 5.7.3, 5.8.2 or 5.9.0 are not affected.


Customers who have downloaded and installed Bitbucket Server >= 4.13.0
less than 5.4.8 (the fixed version for 4.13.0 through to 5.4.7), and
Bitbucket Server >= 5.5.0 less than 5.5.8 (the fixed version for
5.5.x), and Bitbucket Server >= 5.6.0 less than 5.6.5 (the fixed
version for 5.6.x), and Bitbucket Server >= 5.7.0 less than 5.7.3 (the
fixed version for 5.7.x), and Bitbucket Server >= 5.8.0 less than
5.8.2 (the fixed version for 5.8.x)

Please upgrade your Bitbucket Server installations immediately to fix
this vulnerability.



Remote Code Execution via In Browser Editing - CVE-2018-5225

Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank the severity as critical, high, moderate or
low.
This is our assessment and you should evaluate its applicability to
your own IT environment.

Description:

An authenticated user of Bitbucket Server could gain remote code
execution using the in-browser editing feature via editing a symbolic
link within a repository.

All versions of Bitbucket Server before 5.4.8 (the fixed version for
4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for
5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before
5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed
version for 5.8.x) are affected by this vulnerability. Bitbucket
Server 5.9.0 is not impacted by this vulnerability. This issue can be
tracked here:

Fix

We have taken the following steps to address this issue:

Released Bitbucket Server version 5.9.0 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download.
Released Bitbucket Server version 5.8.2 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download-archives.
Released Bitbucket Server version 5.7.3 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download-archives.
Released Bitbucket Server version 5.6.5 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download-archives.
Released Bitbucket Server version 5.5.8 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download-archives.
Released Bitbucket Server version 5.4.8 that contains a fix for this
issue and can be downloaded from
https://www.atlassian.com/software/bitbucket/download-archives.

What You Need to Do:
Atlassian recommends that you upgrade to the latest version. For a
full description of the latest version of Bitbucket Server, see the
release notes. You can download the latest version of Bitbucket Server
from the download centre.


Mitigation:
If you are running an affected version of Bitbucket Server and cannot
upgrade to an unaffected version the following mitigation can be
performed:

Set feature.file.editor=false in the bitbucket.properties file

Restart Bitbucket Server for changes to become effective

Please note that this mitigation does not mitigate against
vulnerabilities where third party plugins use the file editing API
programatically.


Support:
If you did not receive an email for this advisory and you wish to
receive such emails in the future go to https://my.atlassian.com/email
and subscribe to the Alerts emails.

If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/.

References:
Security Bug fix Policy
As per our new policy critical security bug fixes will be back ported
in accordance with
https://www.atlassian.com/trust/security/bug-fix-policy.  We will
release new bug fix releases for the versions covered by the new
policy instead of binary patches.

Binary patches are no longer released:
Severity Levels for security issues.
Atlassian security advisories include a severity level and a CVE
identifier. This severity level is based on our self-calculated CVSS
score for each specific vulnerability. CVSS is an industry standard
vulnerability metric. You can also learn more about CVSS at FIRST.org.
End of Life Policy Our end of life policy varies for different
products. Please refer to our EOL Policy for details.
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJasyPDAAoJEAvDEIrvlEl3bg0H/RFty9+kz8BkSBUWJND73DNl
el9Rs1bh0Bg75DpW+s8r1imaZFpvqBRM+Pzq+1T02Q6hecMBuN6hZ6C5FpOscqED
ooudenumsbKciVNfm8xw7waXYqzONJgOWjvaIlL4xUndkGn34t/F3z371CGJ9Lgw
u8OkmwCcGOYNro1FgiMCRvMKvasfNWmmd+tNNxVE7c0dXnANIoCDen84dLGiWYAy
vNIM0gNPnzp4T39cNQTSdbeZmar46Y+V7aLsHugiNjcBtHX0pFEYDIP5LHQLc1eh
1xujATZv+ca6Z8sn0cKnHZ5PExK+qRwOJPSUctQt2Y/o0wZSYTlGkzKqrz/kc14=
=D8CP
-----END PGP SIGNATURE-----