PT-2024-7918 · Atlassian+4 · Bitbucket Data Center/Server+7

Darkamaul · Published 2024-11-07 · Updated 2025-11-01 · CVE-2024-47072

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.21 Bitbucket Data Center and Server versions 8.6.0 through 8.19.0 Bitbucket Data Center and Server versions 9.0.0 through 9.4.0 Bitbucket Data Center and Server version 8.9.0 through 8.9.23 Bitbucket Data Center and Server version 8.19.0 through 8.19.13 Bitbucket Data Center and Server version 9.4.0 through 9.4.1

Description The issue is related to a stack overflow error in the BinaryStreamDriver component of the XStream library, which can be exploited by a remote attacker to terminate the application, resulting in a denial of service. This can be achieved by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. The vulnerability may allow an attacker to expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, and high impact to availability.

Recommendations For XStream versions prior to 1.4.21, upgrade to version 1.4.21 or later. For Bitbucket Data Center and Server version 8.9.0 through 8.9.23, upgrade to a release greater than or equal to 8.9.24. For Bitbucket Data Center and Server version 8.19.0 through 8.19.13, upgrade to a release greater than or equal to 8.19.14. For Bitbucket Data Center and Server version 9.4.0 through 9.4.1, upgrade to a release greater than or equal to 9.4.2. For Bitbucket Data Center and Server version 9.5, upgrade to a release greater than or equal to 9.5.0. As a temporary workaround, users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Stack Overflow

Weakness Enumeration

CWE-502

CWE-121

Related Identifiers

ALT-PU-2025-13422

ALT-PU-2025-3710

BDU:2024-09422

CVE-2024-47072

DLA-4001-1

GHSA-HFQ9-HGGM-C56Q

OESA-2024-2400

OPENSUSE-SU-2024:14480-1

OPENSUSE-SU-2024_4037-1

RHSA-2025:2218

RHSA-2025:2219

RHSA-2025:2220

RHSA-2025:2221

RHSA-2025:2222

RHSA-2025:2223

SUSE-SU-2024:4037-1

SUSE-SU-2024_4037-1

Affected Products

Alt Linux

Astra Linux

Bamboo

Bitbucket

Bitbucket Data Center/Server

Confluence

Red Os

Suse

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47072.json · Exploit
• 🔥 https://github.com/JLLeitschuh/unCVEed/issues/1 · Exploit
• 🔥 https://github.com/huydoppaz/CVE-2024-8698-POC · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:14480-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47072 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-47072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47072 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2400 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47072 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hfq9-hggm-c56q · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09422 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-47072 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4037-1 · Vendor Advisory