April 2017 - HipChat Server Advisory

CVE ID:

* CVE-2017-7357.


Product: Hipchat Server.

Affected Hipchat Server product versions:
All versions < 2.2.3


Fixed Hipchat Server product versions:
2.2.3



Summary:
This advisory discloses a critical severity security vulnerability
that was introduced in version 1.0 of Hipchat Server. Versions of
Hipchat Server starting with versions of Hipchat Server from 1.0 but
less than 2.2.3 (the fixed version), are affected by this
vulnerability. are affected by this vulnerability.

HipChat Cloud instances aren't affected by the issue described in this email.

Customers who have upgraded Hipchat Server to version 2.2.3 are not affected.

Customers who have downloaded and installed any version less than
2.2.3 please upgrade your Hipchat Server installations immediately to
fix this vulnerability.


Remote Code Execution via Administrative Imports (CVE-2017-7357)

Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank the severity as critical, high, moderate or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.


Description:

An attacker with Server Administrator level privileges could gain
Remote Code Execution via a malicious file importation.
All versions of Hipchat Server starting with versions of Hipchat
Server from 1.0 but less than 2.2.3 (the fixed version), are affected
by this vulnerability. are affected by this vulnerability. are
affected by this vulnerability. This issue can be tracked at:
https://jira.atlassian.com/browse/HCPUB-2903 .


Fix:

To address this issue, we've released the following versions containing a fix:

* Hipchat Server version 2.2.3

Remediation:

Upgrade Hipchat Server to version 2.2.3 or higher.

The vulnerabilities and fix versions are described above. If affected,
you should upgrade to the latest version immediately.




For a full description of the latest version of Hipchat Server, see
the release notes found at
https://confluence.atlassian.com/display/hc/hipchat+server+Release+Notes.
You can download the latest version of Hipchat Server from the
download centre found at https://www.hipchat.com/server/get-it.


Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/.