Apache Tomcat in JIRA

[Janaki Lenagala]

I am new to JIRA and Open Source Software. We are using Apache Tomcat in our JIRA server and version is 8.5.72.

May I know what is the purpose of using Apache Tomcat server in JIRA? 

How do we configure it?  is it configured to persist sessions using the FileStore?

May I know how CVE-2022-2318 is affects to Jira system which used Apache tomcat ?

[Daniel Eads]

Hi @Janaki Lenagala ,

Atlassian's security team is evaluating CVE-2022-23181, which was released by the Apache foundation four days ago . Apache's initial severity listing on their mailing list is low. The public issue related to Atlassian's investigation for Jira is JRASERVER-73223 , which you can watch for updates.

Cheers,
Daniel

[Pramodh M]

Hi @Janaki Lenagala 

Apache Tomcat is bundled along with Applications (Jira, Confluence, Bitbucket) 

Here are version references for the same

https://confluence.atlassian.com/jiracore/bundled-tomcat-and-java-versions-1013854250.html

FAQ regarding the same

https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html

Thanks,
Pramodh

[Janaki Lenagala]

Thank you for the reply. 

CVE-2022-23181 is not listed in the above vulnerability list. 

How do we find whether JIRA is vulnerable to CVE-2022-23181 ?