Jackson-databind-2.3.2 update

[Vu Tran]

Hello:

We current have Jira Core 7.1.2 installed.  Lately we were informed by a client that the Jackson-databind-2.3.2 which is included in the deployment package of Jira has serious vulnerabilities.  Can you please let me know the following:

1. Is there an update for this issue?

2.  If there is, how do we deploy the update to the server?

3.  Would the update require a server upgrade to the latest?

Thanks,

-Vu

[Matt Doar]

From the linked j.a.c. issue I see 

"JIRA does not employ methodology which would enable exploitation of these old vulnerabilities(detailed in CVE-2017-15095"

It doesn't sound like the "serious vulnerabilities" are happening. So I'd expect this is a lower priority to fix

[Tinker Fadoua]

Hi Vu

Here is the link to the issue related to the JAR file, you can vote on it:

https://jira.atlassian.com/browse/JRASERVER-66511

[Vu Tran]

Hi Fadoua:

Thank you for the information.  Can you please advise if the related libraries are going to be updated in the next release of Jira or related software?

It appeared Confluence also has this set of library.  It is a major concern for us and our clients when we are looking into using Confluence product for a larger user group.  

Please advise if any remedy action necessary to address this issue.

Thanks again.

-Vu

[Tinker Fadoua]

Hi Vu,

Since there is no update yet from Atlassian on the ticket I sent you yesterday, I will suggest you to open yourself a ticket with Atlassian and share your concerns with them. They may be able to help you.

Click on Atlassian Support to open a ticket with Atlassian.

Hope this helps!

[Vu Tran]

Hi Fadoua:

Since we only have a small user group on starter license, Atlassian is no longer provide immediate support for starter license.  We will have to look to the community for the update of this issue.

Thanks again,

-Vu

[Tinker Fadoua]

Ok Vu let me share your question with other Community Champions see who has some knowledge about your issue. Thanks for your patience!