Jackson-databind-2.3.2 update

Question

Hello:

We current have Jira Core 7.1.2 installed.  Lately we were informed by a client that the Jackson-databind-2.3.2 which is included in the deployment package of Jira has serious vulnerabilities.  Can you please let me know the following:

1. Is there an update for this issue?

2.  If there is, how do we deploy the update to the server?

3.  Would the update require a server upgrade to the latest?

Thanks,

-Vu

Matt Doar_tzgiej · Answer

From the linked j.a.c. issue I see

"JIRA does not employ methodology which would enable exploitation of these old vulnerabilities(detailed in CVE-2017-15095"

It doesn't sound like the "serious vulnerabilities" are happening. So I'd expect this is a lower priority to fix

Tinker Fadoua · Answer

Ok Vu let me share your question with other Community Champions see who has some knowledge about your issue. Thanks for your patience!

Vu Tran · Answer

Hi Fadoua:

Since we only have a small user group on starter license, Atlassian is no longer provide immediate support for starter license.  We will have to look to the community for the update of this issue.

Thanks again,

-Vu