Will there be a 4.x fix for new Bitbucket Server security advisory 2018-03-21

[jcurleyWR]

Will there be a 4.x fix for new Bitbucket Server security advisory 2018-03-21.

We are at 4.8.3 with plans to upgrade to the latest 4.x.

Thank you.

[jcurleyWR · Accepted solution]

I filed a support request. The answer is no. There is a band-aid thing you/we can do if we have an affected version.

Looks like 4.12.x for Q2 and 5.x in Q4.

[Julius Davies [bit-booster.com]]

Versions before 4.13.0 are safe, at least as far as this particular vulnerability is concerned.  As the advisory states:

> This advisory discloses a critical severity security vulnerability which was introduced in version 4.13.0 of Bitbucket Server.

p.s.  If you end up upgrading to 5.x, I found the migration of server.xml to bitbucket.properties config a little painful.  I was also bit by Bitbucket Server Archive Plugin's functionality transitioning to an integrated feature (no longer requires the plugin) since the URL for commit-based archive downloads changed.   For the most part migrating was 5.x was pretty smooth, but it does require some QA.

[jcurleyWR]

Thank you G. Sylvie Davies.

I saw the notes on upgrading to 5.x and your comment confirms that it will not be an easy upgrade.

We are planning to upgrade to 4.14.4 (or whatever the latest version is), to avoid the Bitbucket 5.x upgrade experience. I figure having to upgrade from mysql 5.1 to 5.6 is enough of a hurdle at this point.

So that's why I asked my question. If Atlassian doesn't plan to fix the security flaw on the 4.x release branch, then I'll have to plan for a bigger effort.

Or maybe I'll go for 4.12.x, it also has some fixes and features we're interested in.

Thanks again.