What version of Jira will not be susceptible to the Diffie-Hellman vulnerability?

Greg Elofson_dw9hts

We're about to do a long overdue upgrade. We've considered Jira 7.6 because of its Enterprise designation, and the reduced maintenance it would presumably require. 

 

But, we would like to be sure that Jira 7.6 cannot be affected by the Diffie-Hellman vulnerability. 

 

The research I've done indicates that the determining factor is not necessarily the Jira version, per se, but rather whether the Jira version uses Java version 8 -- because it can be configured to use 2048 bit-group as documented at Logjam (CVE-2015-4000) and Atlassian Products.

 

Can anyone recommend which Jira version to use, in light of our need to avoid the Diffie-Hellman vulnerability?

Alexis Robert

Hi @Greg Elofson, 

 

FYI Jira 7.13 is the new Enterprise release, I'd recommend using this one rather than 7.6 if you can

 

For your question, it depends how you're implementing SSL on your Jira instance: do you use a reverse-proxy like Apache or Nginx, or Tomcat with keytool to implement certificates ?

The problem is with the size of the DH Group used by your software to exchange security keys, so it can be fixed in different ways depending on how you implement security on your side. 

If you're using a reverse-proxy, then you should fix weak DH following this guide.

If you're using Tomcat, then it should be fixed in server.xml following this guide.

 

Let me know if you have any questions, 

 

--Alexis