Security Advisory for JSM

[Darlene Gariepy]

We are current running Jira Software 8.19.1 Data Center with Jira Service Management 4.19.1.

With Insight 9.1.0 app installed. We are wanting to know if we are affected by the recent 

Jira Service Management Security Advisory 2021-10-20 ?

Thanks,

Brandon

[Daniel Eads]

Hi @Darlene Gariepy / Brandon,

You are affected by this advisory, as the version of Insight bundled with Jira Service Management Data Center is vulnerable until JSM Data Center is upgraded to 4.20.

If you cannot upgrade JSM Data Center right away, please follow the mitigation steps laid out in the advisory in order to work around the vulnerability as a temporary measure until you can work through an upgrade.

Cheers,
Daniel | Atlassian Community

[Robert Wen_Cprime_]

You should be OK.  The versions of Insight under question are the ones before 8.9.3 according to the security bulletin.

https://confluence.atlassian.com/adminjiraserver/jira-service-management-security-advisory-2021-10-20-1085186548.html

[Daniel Eads]

For clarity, the 9.x versions indicate the Insight app is bundled with Jira Service Management Data Center (vs standalone/non-bundled versions such as 8.x), and don't relate to being before/after fixed versions in the advisory.