nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Workaround for the vulnerabilities aside from upgrade

Paul Bien

Around 2 months ago, we just recently upgraded to Jira version 8.9.0 and now we are getting some vulnerabilities on the said version. Here are the vulnerabilities that we have:

- atlassian-jira-cve-2020-4028

- atlassian-jira-cve-2020-4022

- atlassian-jira-cve-2020-14168

- atlassian-jira-cve-2020-14169

- atlassian-jira-cve-2020-14174

- atlassian-jira-cve-2020-14167

I want to ask if there is a way to remediate this vulnerabilities without doing another upgrade to a fixed version. We want to stay with version 8.9.0 for now as doing another upgrade is not feasible for us right now. Please let me know if there's a workaround for these vulnerabilities on version 8.9.0. Thank you!

Accepted answers

Nic Brough -Adaptavist-

There is no supported way to fix these vulnerabilities other than to upgrade to a version that does not have them.

If you were on a long-term-support (previously called "enterprise") version, then point-releases or patches from Atlassian would be available. But you are not, so your only options are to upgrade, or work out your own patches for them (including re-testing every affected area and worrying about compatibility) and render your Jira unsupported

All comments

Nic Brough -Adaptavist-

There is no supported way to fix these vulnerabilities other than to upgrade to a version that does not have them.

Paul Bien

Thanks for the response Nic!

Paul Bien

Just a follow-up question Nic, if we are on a long-term-support version, what will be the process to acquire and apply the point-releases or patches from Atlassian? Thanks!

Nic Brough -Adaptavist-

I think you got a good answer from Bastien over at https://community.atlassian.com/t5/Jira-Software-questions/What-is-the-process-to-acquire-and-apply-the-point-releases-or/qaq-p/1494496 - it's what I would have said too.

Note that Atlassian sometimes (although not frequently) do "patches" rather than releases. These have their own installation process which is usually more along the lines of "replace a file or files in the server installation with the distributed files". But this is rare.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server

vulnerability