PT-2024-23224 · Atlassian+3 · Bitbucket Data Center/Server+8

Published 2024-05-09 · Updated 2026-03-18 · CVE-2024-30172

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Bouncy Castle Java Cryptography APIs versions 1.73 through 1.77 Bitbucket Data Center and Server versions 8.9.5 through 8.19.0 Bamboo Data Center and Server versions 9.2.11 through 9.6.0 Confluence Data Center and Server version 3.7 Confluence Data Center and Server versions 7.19 through 8.9 before 8.9.4 Confluence Data Center and Server versions 8.5 through 8.5.11 Confluence Data Center and Server version 9.0 before 9.0.1

Description An issue was discovered in Bouncy Castle Java Cryptography APIs. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. This allows an unauthenticated attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.

Recommendations For Bouncy Castle Java Cryptography APIs versions 1.73 through 1.77, upgrade to version 1.78 or later. For Bitbucket Data Center and Server versions 8.9.5 through 8.19.0, upgrade to a release greater than or equal to 8.9.14 for version 8.9, or upgrade to a release greater than or equal to 8.19.3 for version 8.19. For Bamboo Data Center and Server versions 9.2.11 through 9.6.0, upgrade to a release greater than or equal to 9.2.14 for version 9.2, or upgrade to a release greater than or equal to 9.5.4 for version 9.5, or upgrade to a release greater than or equal to 9.6.2 for version 9.6. For Confluence Data Center and Server version 3.7, upgrade to a supported fixed version. For Confluence Data Center and Server versions 7.19 through 8.9 before 8.9.4, upgrade to a release greater than or equal to 7.19.26 for version 7.19, or upgrade to a release greater than or equal to 8.5.12 for version 8.5, or upgrade to a release greater than or equal to 8.9.4 for version 8.9. For Confluence Data Center and Server version 9.0 before 9.0.1, upgrade to a release greater than or equal to 9.0.1.

Exploit

Fix

Infinite Loop

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-835

CWE-347

Related Identifiers

BDU:2025-14524

CVE-2024-30172

GHSA-M44J-CFRM-G8QC

OPENSUSE-SU-2024:13914-1

RHSA-2024:5143

RHSA-2024:5144

RHSA-2024:5145

RHSA-2024:5479

RHSA-2024:5481

USN-8108-1

Affected Products

Bamboo

Bamboo Data Center/Server

Bitbucket

Bitbucket Data Center/Server

Confluence

Confluence Data Center/Server

Debian

Linuxmint

Ubuntu

References · 34

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172 · Exploit
• 🔥 https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-30172 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-33201 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-30171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m44j-cfrm-g8qc · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/720109 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-30172 · Security Note
• https://ubuntu.com/security/CVE-2024-29857 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14524 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30172 · Security Note
• https://ubuntu.com/security/CVE-2024-30172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30172 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-30172 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30172 · Vendor Advisory