NTP clock variables information disclosure

Sriram Subramanian_8poq2s

Team,

Need to address the vulnerability "NTP clock variables information disclosure", may I know how do we check and fix this? I have jira 7.12 version and we are soon planning to upgrade to 8.6 in near future. however with the current version, vulnerability arose and may i know if there is a workaround to fix this or how do we do go about it? 

Regards

Sriram S 

Andy Heinzer

Hi Sriram,

I am confused by your question here. To the best of my knowledge Jira Service Desk has never had any such kind of security issue like the one you are describing.  We do track security issues in our products such as in https://www.atlassian.com/trust/security/advisories

And while there have been two security issues for Jira Service Desk since 2017

• https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2019-11-06-979412717.html
• https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2019-09-18-976171274.html

neither of these have anything to do with NTP clock variables.  Those terms are not something I believe Jira Service Desk has anything to do with.  Could you let me know more details about what CVE you are referring to here?

Regards,

Andy