nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

OpenJDK Vulnerability CVE-2021-2388

The bin installer of Jira server 8.19 is using the JDK11.0.11, and is affected by the below vulnerability

Based on 20 Jul 21 OpenJDK advisory,

https://openjdk.java.net/groups/vulnerability/advisories/2021-07-20

OpenJDK Vulnerability Advisory: 2021/07/20

The following vulnerabilities in OpenJDK source code were fixed in this release. The affected versions are 16.0.1, 15.0.3, 13.0.7, 11.0.11, 8u292, 7u301, and earlier. Please note that defense-in-depth issues are not assigned CVEs. We recommend that you upgrade as soon as possible.

https://nvd.nist.gov/vuln/detail/CVE-2021-2388

I have installed on-prem using the Jira 8.19 bin installer

Not sure if 8.19.1 has fixed this?

Accepted answers

All comments

Carlos Garcia Navarro

Hi jy,

I didn't find a reference to this fix in the release notes:

https://confluence.atlassian.com/jiracore/jira-core-8-19-x-release-notes-1082527670.html

I was also looking for a reference in the Atlasian Jira project that tracks fixes but didn't find CVE-2021-2388 :

https://jira.atlassian.com/issues/?jql=text%20~%20CVE-2021-2388

I tried to create a issue on this , but I can't create as I do not have the permissions to.

If possible, can someone help to create a issue on this?

Thanks.

I installed the latest version 8.19.1, and check it is using AdoptOpenJDK11.0.11 , which is still affected by the CVE.

Adrian Stephen_q490r0

Hi everyone, thank you for reporting this.

I have raised the bug here :

https://jira.atlassian.com/browse/JRASERVER-72880

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira-software

jira-software-server