CVE-2021-42574 upgrade support

E-comm E-comm

Hi with reference to vulnerability - CVE-2021-42574 - Multiple Products Security Advisory - Unrendered unicode bidirectional override characters - CVE-2021-42574 | Atlassian Support | Atlassian Documentation we need to upgrade.

 

Can we do an in place upgrade form our existing version 7.5.1 to 
7.13.18. Or event version 8. 

 

Can we just sue the installer ? - Upgrading JIRA applications using the installer | Administering Jira applications Data Center and Server 7.5 | Atlassian Documentation

 

Thanks Ross

 

 

Daniel Eads

Hi Ross,

I see this question has gone unanswered! An upgrade is in order for your 7.5 instance.

There are two primary concerns when considering an upgrade:

1. License eligibility - I've taken a peek and your license is still in active support, so you can upgrade all the way up to the latest Jira release. You may need to retrieve the latest license key from https://my.atlassian.com - you can enter this now even before upgrading on the Versions & Licenses page in Jira's administration. If you don't have the latest key entered before upgrading, Jira will prompt you for the updated key when you start it up after the upgrade.
2. Supported platforms - it's unlikely that the database version you're on now is supported in the latest Jira releases. You may need to do an upgrade in multiple steps in order to upgrade Jira, then the database, then Jira again. If you happen to know the database you're on now (MySQL 5.4, Microsoft SQL 2014, etc) then I can suggest the shortest possible upgrade path for you.

The document you've linked is a great resource for upgrading, and the supported platform concern is outlined in that document.

I will note that you need to upgrade to Jira 8.13.13 , or 8.20.1 (or newer) in order to mitigate against this CVE. There are no versions of Jira 7 with the fix for this CVE.

Cheers,
Daniel | Atlassian Community Support