Atlassian and the Internet Systems Consortium (ISC) have recently disclosed security vulnerabilities in their products that could potentially lead to denial-of-service (DoS) attacks and remote code execution.
Description
Atlassian has taken action to address four high-severity flaws in their products. These include a deserialization flaw in the Google Gson package that affects Patch Management in Jira Service Management [7], a DoS flaw in Confluence [1] [7], a remote code execution flaw in Bitbucket [1] [5] [7], and a DoS flaw in Apache Tomcat server impacting Bamboo [1] [5] [7]. The company has released specific versions of Jira Service Management [5], Confluence [1] [2] [3] [4] [5] [6] [7], Bitbucket [1] [2] [3] [4] [5] [6] [7], and Bamboo last month to fix these vulnerabilities.
Similarly, ISC has released fixes for two high-severity flaws in their BIND 9 DNS software suite [1] [2] [3] [4] [7]. These fixes address a stack exhaustion flaw and a named service termination flaw [1]. It is worth noting that ISC had previously rolled out fixes for three other flaws in their software that could also result in DoS conditions [3].
Conclusion
The latest patches from ISC come after they previously fixed three other flaws in the software that could also lead to a DoS condition [5]. It is crucial for users of Atlassian and ISC products to update to the latest versions to mitigate the risk of potential attacks. These security vulnerabilities highlight the ongoing need for organizations to prioritize and regularly update their software to ensure the safety and integrity of their systems.
References
[1] https://secoperations.wordpress.com/2023/09/23/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server/
[2] https://flyytech.com/2023/09/24/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server/
[3] https://techinvestornews.io/2023/09/22/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server/
[4] https://thehackernews.com/2023/09/high-severity-flaws-uncovered-in.html
[5] https://thecybersecurity.news/general-cyber-security-news/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server-27507/
[6] https://cyber.vumetric.com/security-news/2023/09/22/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server/
[7] https://www.redpacketsecurity.com/high-severity-flaws-uncovered-in-atlassian-products-and-isc-bind-server/
