nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Out of contract security patches

Andy Harrison4

We currently have an active support license for the download edition of Jira, I was wondering what would happen once our license expires if another issue crops up like the one in todays security alert?

On the atlassian site it talks about renewing your software maintenance as being entirely optional (http://www.atlassian.com/licensing/purchase-licensing#softwaremaintenance-2) and talks about giving you new features and online support - but no mention of security fixes.

I'd hope that critical security patches would be released to everyone, regardless of support contract status, at least for a reasonable lifetime of the product ... but I can't find a clear statement either way.

Accepted answers

Harry Chan5

As per your link, "After the first 12 months, your software maintenance will expire and you will no longer be able to receive technical support or software updates."

I think it depends on the natural of the security patch. In instances where I've seen only particular jars are patched, you can easily do that, but when it's a totally new version release then you'd need a license.

All comments

Harry Chan5

As per your link, "After the first 12 months, your software maintenance will expire and you will no longer be able to receive technical support or software updates."

Andy Harrison4

The security advisory today seemed pretty serious (potential admin access for non-account holders), and came with some links to patches for older releases, so I guess you'd be able to apply those without a current license? ... but would we still have been sent the security alert emails to even find out about the issue?

Harry Chan5

Hi, are you referring to the Bamboo Security issue? https://jira.atlassian.com/browse/BAM-12066 - the one here's definitely a patch on some files. As it's not a version upgrade, it should be fine.

Edit: same for JIRA https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-08-28 - provided you're on a version that can be patched. Edit: however, this JIRA one does need upgrading to JIRA 5.1. Not all the issues can be solved by patching.

Andy Harrison4

It was this one in particular (one of the issues in the Jira advisory you linked to) that'd concern me the most: https://jira.atlassian.com/browse/JRA-29403.

When out of contract would we still get these security advisory emails so we could at least look into whether a patch is available, and if not weigh up the pros/cons of renewing the license for an upgrade? Or would we only find out if we got hacked?

davead75

~~~ spam ~~~

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira