{"id":45900,"date":"2022-03-25T15:45:13","date_gmt":"2022-03-25T15:45:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/atlassian-flags-bitbucket-and-confluence-data-center-flaws\/"},"modified":"2022-03-25T15:45:13","modified_gmt":"2022-03-25T15:45:13","slug":"atlassian-flags-bitbucket-and-confluence-data-center-flaws","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/atlassian-flags-bitbucket-and-confluence-data-center-flaws\/","title":{"rendered":"Atlassian flags Bitbucket and Confluence Data Center flaws"},"content":{"rendered":"

Atlassian has demonstrated the interconnectedness of all things with a warning<\/a> that some versions of Bitbucket Data Center and Confluence Data Center require patching courtesy of the Hazelcast Java deserialization vulnerability.<\/p>\n

Hazelcast is an in-memory data grid and spreads data over the nodes of a cluster and is used for efficiency and performance via its in-memory tech. It is also relatively environment agnostic, running happily on-premises or in Microsoft, Amazon, and Google’s clouds.<\/p>\n

The vulnerability affects products running as a cluster; the Server and Cloud versions of Bitbucket and Confluence are not affected. Exploitation is via a specially crafted JoinRequest with the potential result of arbitrary code execution.<\/p>\n