nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why is LTS version 8.13.6 still shows the same vulnerabilities as with 8.13.2

Paul Bien

We were previously on LTS version 8.13.2 but we got some vulnerabilities for the said version. It was stated to upgrade to a higher version in order to remediate the vulnerabilities so we upgraded to the latest LTS version 8.13.6. Once we are already in LTS version 8.13.6, same vulnerabilities are still showing up as it seems the latest LTS version 8.13.6 doesn't have the fix for the vulnerabilities. Can anyone please confirm if the below vulnerabilities are really fixed in the latest LTS version 8.13.6?

- atlassian-jira-cve-2021-26070
- atlassian-jira-cve-2020-36237
- atlassian-jira-cve-2020-29453
- atlassian-jira-cve-2020-36235
- atlassian-jira-cve-2020-29451
- atlassian-jira-cve-2021-26069
- atlassian-jira-cve-2020-36236
- atlassian-jira-cve-2020-36234
- atlassian-jira-cve-2020-36286
- atlassian-jira-cve-2020-36238
- atlassian-jira-cve-2020-36288
- atlassian-jira-cve-2021-26075
- atlassian-jira-cve-2021-26071
- atlassian-jira-cve-2021-26076

All of these vulnerabilities were showing on our previous LTS version 8.13.2 but are also still showing on our current setup which is on the latest LTS version 8.13.6. Thank you!

Accepted answers

Nic Brough -Adaptavist-

The simple answer is that Atlassian have not fixed them.

Without reading each one, I can't tell you if this is the exact case, but there are several places that the security problems may occur - Jira itself of course, but also the Tomcat it's running on, the Java it is using, some of the libraries Jira or Tomcat are using, and sometimes even the apps loaded into Jira (although those cves are usually recorded against the app rather than Jira and are the responsibility of the authors more than Atlassian)

Atlassian do not commit to fixing every cve every time one is raised. They're all considered for development, but not all will make the cut on every point release, and there's all sorts of reasons for that, not least the complexity of moving up a Tomcat version, a Java version or upgrading a library for a fix - it's a complex web of dependencies and reliances, and those are not always minor changes that you can get done in one go.

All comments

Nic Brough -Adaptavist-

The simple answer is that Atlassian have not fixed them.

Paul Bien

Hi Nic,

Thanks for the response!

The mentioned vulnerabilities are Jira/Atlassian specific vulnerabilities and most of these vulnerabilities, if not all, are recommending to upgrade to a higher version than 8.13.2 to remediate the vulnerabilities. Also, similar reports to this also states the versions that are affected by the vulnerabilities and those that are not so we went to the latest LTS version 8.13.6 as most of these vulnerabilities, if not all, only affects versions lower than 8.13.3 for LTS. Now we are wondering why version 8.13.6 is still showing these vulnerabilities. You said that they may have not fixed them yet but it is already in their recommendation which version to go to for the fix so it is kinda misleading. Thanks!

Nic Brough -Adaptavist-

What do you mean by "still showing"?

Paul Bien

Hi Nic,

Let's use atlassian-jira-cve-2021-26070 as an example (part of the vulnerabilities I listed above). The description for the said vulnerability is "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1." As said, we upgraded to version 8.13.6 which should no longer be affected by the said vulnerability based on the description but on our latest vulnerability scan, the said vulnerability is still showing as a vulnerability for our Jira even though our Jira is already in version 8.13.6. Thanks!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server