Is Bamboo server 7.2.4 affected by Tomcat vulnerability CVE-2022-25762
Asked by niraj:

Hello,

Is Bamboo server 7.2.4 affected by Tomcat vulnerability CVE-2022-25762?

Do I have to upgrade my bamboo version?

Thanks


Answers:
author: Eduardo Alvarenga
body: Hello [@niraj](/t5/user/viewprofilepage/user-id/5024125),

Welcome to **Atlassian Community!**

Short Answer: **Not vulnerable**

CVE-2022-25762 does not affect Bamboo as Bamboo does not use Web sockets.

Customers are free to manually update Bamboo's embedded Tomcat to version 8.5.76 or later as instructed on this page:

* [How to upgrade Apache Tomcat version used by Bamboo \| Bamboo \| Atlassian Documentation](https://confluence.atlassian.com/bamkb/how-to-upgrade-apache-tomcat-version-used-by-bamboo-1115656288.html)

Sincerely,

Eduardo Alvarenga  
Atlassian Support APAC

**--please don't forget to Accept the answer if the reply is helpful--**

comments: author: niraj
body: Thanks for the Reply Eduardo,

But my Bamboo instance is publically accessible, and the tomcat version 8.5.64 is vulnerable.

So do I have to upgrade Tomcat because of this vulnerability?

Or we are safe even if the tomcat version is vulnerable?

Can you please also clarify this part? Our security team is asking us to upgrade the tomcat because of this vulnerability.

Thanks,

Niraj


author: Eduardo Alvarenga
body: Hello [@niraj](/t5/user/viewprofilepage/user-id/5024125)

It is highly recommended that you upgrade Bamboo to ***at least*8.2.5** due to the following vulnerabilities (not only Tomcat)!

* [BAM-21588: log4j dependency is exposure to CVE-2021-4104 (fixed in Bamboo 8.1.2, 8.0.6, 8.2.0)](https://jira.atlassian.com/browse/BAM-21588)
* [BAM-21834: Bamboo Struts security vulnerability CVE-2021-31805 (fixed in Bamboo 8.0.7, 8.2.2, 8.1.6, 7.2.10)](https://jira.atlassian.com/browse/BAM-21834)
* [FAQ for CVE-2022-22965](https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html)
* [BAM-21755: Update Spring to 5.3.18+ to mitigate CVE-2022-22965 (fixed in Bamboo 8.0.7, 8.2.2, 8.1.6)](https://jira.atlassian.com/browse/BAM-21755)
* [BAM-21769: Upgrade Tomcat to mitigate CVE-2022-29885 (fixed in Bamboo 8.0.10, 8.1.9, 8.2.5)](https://jira.atlassian.com/browse/BAM-21769)
* [FAQ for CVE-2022-26136 / CVE-2022-26137](https://confluence.atlassian.com/kb/faq-for-cve-2022-26136-cve-2022-26137-1141988432.html)

By default, the primary technical contact for a Support Entitlement Number (SEN) will always receive emails regarding security vulnerabilities as well as other technical alerts (pricing changes, maintenance notifications, etc). Make sure to keep the technical contact updated for the referring Support Entitlement Number:

* [How do I update the billing and technical contacts for my Atlassian products?](https://www.atlassian.com/licensing/purchase-licensing#how-do-i-update-the-billing-and-technical-contacts-for-my-atlassian-products)

If you prefer having a more directed approach, you can subscribe your account to our Security Advisories mailing list. To ensure you are on this list, please update your email preferences at [https://my.atlassian.com/email](https://my.atlassian.com/email?_ga=2.238459712.1996414290.1580085799-1626374304.1576177848&_gac=1.41223958.1580085799.EAIaIQobChMIpK-wosai5wIVxBx9Ch3B1QM0EAAYASAAEgJ7cPD_BwE) under "Tech Alerts".

You can find more information on how we deal with Security Advisories here:

* [Security Advisory Publishing Policy - Atlassian](https://www.atlassian.com/trust/security/advisory-publishing-policy)

We recommend you [renew your Bamboo subscription](https://www.atlassian.com/licensing/bamboo), install the updated License string and plan your [Bamboo upgrade](https://confluence.atlassian.com/bamboo/bamboo-upgrade-guide-720411366.html).

Kind regards,

Eduardo Alvarenga  
Atlassian Support APAC

**--please don't forget to Accept the answer if the reply is helpful--**


author: niraj
body: Thanks Eduardo for clarifying.


Tags: tomcat

upgrade