nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Jira software 8.17 has jdk vulnerabilities

jy_jmvvjg

I have tried before using the rpm jdk to run jira application, it does not work, as some inbuilt path uses the jira jdk path to run.

Currently our Nessus software has detected 1 high, 2 medium vulnerabilities related to jre.

High -Oracle Java SE 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 Multiple Vulnerabilities

The following vulnerable instance of Java is installed on the
remote host :
Path : /opt/atlassian/jira
Installed version : 1.8.0_275
Fixed version : 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2

Medium-Oracle Java SE 1.7.0_291 / 1.8.0_281 / 1.11.0_10 / 1.15.0_2 Information Disclosure

The following vulnerable instance of Java is installed on the
remote host :
Path : /opt/atlassian/jira
Installed version : 1.8.0_275
Fixed version : 1.7.0_291 / 1.8.0_281 / 1.11.0_10 / 1.15.0_2

Oracle Java SE 1.7.0_301 / 1.8.0_291 / 1.11.0_11 / 1.16.0_1 Multiple Vulnerabilities (Unix Apr
2021 CPU)

The following vulnerable instance of Java is installed on the
remote host :
Path : /opt/atlassian/jira
Installed version : 1.8.0_275
Fixed version : 1.7.0_301 / 1.8.0_291 / 1.11.0_11 / 1.16.0_1

May I know how to update this jre?

Accepted answers

All comments

Andy Heinzer

Hi @jy

We have ticket that tracks the update of the bundled Java that is include in Jira Server/Data Center editions. The most recent of which is JRASERVER-72515. Updating Jira to 8.18.1 will update the bundled Java to 8u292, which will address at least the two medium vulns listed there.

However the version bundled does not appear to address the other vuln you mentioned. In which case, you can install your own version of Java and then tell Jira to use that version. Steps to do this are in Jira Server: Installing Java. Once your updated version is installed on your operating system, you will need to set the JAVA_HOME variable in your environment. That document also has steps on how to do that for various environments. After that is set, you will then need to start or restart Jira to get it to start using that updated jre/jdk environment.

I hope that helps.

Andy

jy_jmvvjg

I have tried with the second solution, install own openjdk rpm then set the JAVA_HOME to point to the openjdk java path in setenv.sh. I remembered I tried this and the Jira Application didnt start. Seems like some of the paths are still using the jdk in the jira path. Not sure what went wrong.

Andy Heinzer

I am not sure what you mean by

set the JAVA_HOME to point to the openjdk java path in setenv.sh

You should not have to touch the setenv.sh file in order to make this work.

Try following the documentation guide for setting JAVA_HOME as explained in Jira Server: Installing Java:

On Linux

The JAVA_HOME environment variable is sometimes set in the /etc/environment file. You'll need to modify its value to JAVA_HOME="path/to/JAVA_HOME".
If JAVA_HOME is not defined in this file, set it using the following command at a shell prompt, when logged in with 'root' level permissions:
export JAVA_HOME="path/to/JAVA_HOME" >> /etc/environment
Log out for these changes to apply.

Once that is done, log back into that session and try

echo $JAVA_HOME

to see what value is returned in the terminal. If this is working as expected, then you should get back the path of your installed Java version. If the path is correct, then try to start Jira.

jy_jmvvjg

so can you tell me what ver is supported

I have done yum install java-11-openjdk-devel

After that I did as what you did, I added the

export JAVA_HOME="/usr/bin/java" >>/etc/environment

Then I stop-jira.sh and start-jira.sh

Then when I start jira

It is using JRE_HOME=/opt/atlassian/jira/jre

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server