Jira Service Management Security Advisory 2021-10-20 and JIRA Service Desk 4.9.0

[Joseph Wrzosek]

Hi. I had the Jira Service Management Security Advisory 2021-10-20 pop up in my service desk today, and looked through the advisory, and I don't see any mention of JIRA Service Desk 4.9.0, which is what I'm running.  Does this advisory impact me?  Looking at the Manage Apps console and it does not appear that Insight is installed.  Thanks!

[Daniel Eads · Accepted solution]

Hi @Joseph Wrzosek , welcome to the Community!

This notification went out to admins on all Jira Service Management Server (formerly known as Jira Service Desk) and Data Center instances. Dismissing, clicking off, or opening the link will dismiss the notification permanently.

Getting the notification does not necessarily mean your instance is impacted. For your case, you're on a version of Jira Service Desk where you would have needed to install the Insight plugin from the Atlassian Marketplace in order to be affected. Since you've checked and found the Insight plugin is not installed on your instance, your impact is not affected.

You can still take the mitigation steps described in the security advisory itself if you wish. The mitigation involves removing a .jar file from the install directory of your server. If you are on a supported production database (MySQL, MS SQL, PostgreSQL) the mitigation can be safely applied even if you do not have the Insight app installed.

Cheers,
Daniel | Atlassian Support

[Joseph Wrzosek]

Thanks, Daniel. That is helpful!