Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN115

_____________________________________________________________________

DATE                : 20/02/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Jira Software Data Center and
           Server versions prior to 9.4.28, 9.12.15, 9.17.4, 10.1.2.

=====================================================================
https://jira.atlassian.com/browse/JSWSERVER-26299
_____________________________________________________________________

DoS (Denial of Service) com.google.protobuf:protobuf-java Dependency
in Jira Software Data Center and Server


    Type:
    Icon: Public Security Vulnerability Public Security Vulnerability
    Resolution:
    Fixed
    Priority:
    Icon: High High
    Fix Version/s:
    9.4.28, 9.12.15, 9.17.4, 10.1.2
    Affects Version/s:
    9.4.0, 9.4.1, 9.6.0, 9.4.2, 9.4.3, 9.7.0, 9.4.4, 9.8.0, 9.4.5,
9.9.0, 9.4.6, 9.4.7, 9.10.0, 9.4.8, 9.11.0, 9.4.9, 9.12.0, 9.4.10,
9.4.11, 9.4.12, 9.12.1, 9.4.13, 9.4.14, 9.4.15, 9.12.2, 9.4.16,
9.13.0, 9.14.0, 9.12.3, 9.15.0, 9.4.17, 9.12.4, 9.4.18, 9.12.5,
9.12.6, 9.12.7, 9.4.19, 9.4.20, 10.0.0, 9.4.21, 9.12.8, 9.16.1,
9.4.22, 9.17.0, 9.12.9, 9.12.12, 9.4.23, 9.12.10, 9.12.11, 9.4.24,
9.17.1, 9.4.25, 9.4.26, 9.12.13, 9.17.2, 10.1.1, 9.4.27, 9.12.14,
9.17.3
    Component/s:
    None
    Labels:
        advisory advisory-to-release dont-import security 

    CVSS Score:
    8.7
    CVSS Severity:
    High
    CVE ID:
    CVE-2024-7254
    Vulnerability Source:
    Atlassian (Internal)
    CVSSv3 Vector:
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Vulnerability Classes:
    DoS (Denial of Service)	
    Affected Product(s):
    Jira Software Data Center, Jira Software Server	

This High severity com.google.protobuf:protobuf-java Dependency
vulnerability was introduced in versions 9.4.0, 9.6.0, 9.7.0,
9.8.0, 9.9.0, 9.10.0, 9.11.0, 9.12.0, 9.13.0, 9.14.0, 9.15.0,
9.16.1, 9.17.0, 10.0.0, and 10.1.1 of
Jira Software Data Center and Server.

This com.google.protobuf:protobuf-java Dependency vulnerability,
with a CVSS Score of 8.7 and a CVSS Vector of
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
allows an attacker to expose assets in your environment susceptible
to exploitation.

Atlassian recommends that Jira Software Data Center and Server
customers upgrade to latest version, if you are unable to do so,
upgrade your instance to one of the specified supported fixed
versions:

    Jira Software Data Center and Server 9.4: Upgrade to a
release greater than or equal to 9.4.28

    Jira Software Data Center and Server 9.12: Upgrade to
a release greater than or equal to 9.12.15

    Jira Software Data Center and Server 9.17: Upgrade to
a release greater than or equal to 9.17.4

    Jira Software Data Center and Server 10.1: Upgrade to
a release greater than or equal to 10.1.2

See the release notes
(https://www.atlassian.com/software/jira/download-archives).
You can download the latest version of Jira Software Data Center
and Server from the download center
(https://www.atlassian.com/software/jira/download-archives).

The National Vulnerability Database provides the following
description for this vulnerability: Any project that parses
untrusted Protocol Buffers data containing an arbitrary number
of nested groups / series of SGROUP tags can corrupted by
exceeding the stack limit i.e. StackOverflow. Parsing nested
groups as unknown fields with DiscardUnknownFieldsParser or
Java Protobuf Lite parser, or against Protobuf map fields,
creates unbounded recursions that can be abused by an attacker.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================