Does Atlassian bamboo server 7.2.4 use Apache Commons Text ver 1.5-1.9?(CVE-2022-42889)
Asked by Niraj Wagh:

Hi, does Atlassian Bamboo server version use Apache Commons Text?

Since a vulnerability is reported in CVE-2022-42889.

Thanks,

Niraj


Answers:
author: Eduardo Alvarenga
body: Hello [@Niraj Wagh](/t5/user/viewprofilepage/user-id/5024121)

Bamboo 8.0 and 9.0 series uses Apache Commons Text v1.9.

Bamboo 7.2 uses Apache Commons Text v1.1.

~~As of today, 18/10/2022, Atlassian is currently evaluating if Bamboo is vulnerable to CVE-2022-42889. We don't have much information to disclose at this stage and/or if a patch is going to be published.~~

**Update 19/10/2022:** Bamboo is not vulnerable to [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) as it does not use the *StringSubstitutor* module of commons-text. We will obviously bump the dependency to 1.10.0 in the next point release.

If you have a valid Bamboo subscription and you prefer having a more directed approach, you can subscribe your account to our Security Advisories mailing list. To ensure you are on this list, please update your email preferences at [https://my.atlassian.com/email](https://my.atlassian.com/email?_ga=2.238459712.1996414290.1580085799-1626374304.1576177848&_gac=1.41223958.1580085799.EAIaIQobChMIpK-wosai5wIVxBx9Ch3B1QM0EAAYASAAEgJ7cPD_BwE) under "Tech Alerts".

You can find more information on how we deal with Security Advisories here:

* [Security Advisory Publishing Policy - Atlassian](https://www.atlassian.com/trust/security/advisory-publishing-policy)

Here's the official page on Bamboo vulnerabilities:

* [Bamboo Security advisories](https://confluence.atlassian.com/bamboo/bamboo-security-advisories-289276756.html)

To find the version of bundled software in Bamboo, please check the following KB article:

* [How to find the version of bundled software in Bamboo](https://confluence.atlassian.com/bamkb/how-to-find-the-version-of-bundled-software-in-bamboo-1115668736.html)

Kind regards,

Eduardo Alvarenga  
Atlassian Support APAC

**--please don't forget to Accept the answer if the reply is helpful--**

comments: author: Niraj Wagh
body: Hi [@Eduardo Alvarenga](/t5/user/viewprofilepage/user-id/4365410), I have downloaded the .pom file for Bamboo 7.2.4 using the third document link mentioned in your answer. ([https://packages.atlassian.com/maven/repository/public/com/atlassian/bamboo/atlassian-bamboo/7.2.4/atlassian-bamboo-7.2.4.pom](https://packages.atlassian.com/maven/repository/public/com/atlassian/bamboo/atlassian-bamboo/8.0.4/atlassian-bamboo-8.0.4.pom))

In the .pom file, I checked for commons-text, and the version mentioned there is 1.1.

\<dependency\>  
\<groupId\>org.apache.commons\</groupId\>  
\<artifactId\>commons-text\</artifactId\>  
\<version\>1.1\</version\>  
\</dependency\>

Does that mean Bamboo server 7.2.4 uses Apache commons-text 1.1?

Thanks,

Niraj


author: Eduardo Alvarenga
body: Hey [@Niraj Wagh](/t5/user/viewprofilepage/user-id/5024121)

Yes! You are right. Apache Commons Text 1.9 was introduced only on Bamboo 8.0. Apologies for that. I have amended my comment.

Answering your question, **Bamboo 7.2.4 comes with Apache Commons Text 1.1**.

Kind regards,

Eduardo Alvarenga  
Atlassian Support APAC

**--please don't forget to Accept the answer if the reply is helpful--**


author: Niraj Wagh
body: Hi [@Eduardo Alvarenga](/t5/user/viewprofilepage/user-id/4365410)

Thanks for answering.

Thanks,

Niraj


Tags: apache