All of our atlassian products are showing a vulnerability due to incorrectly configured Strict-Transport-Security header on the web servers. I've found fixes for jira, and I'm assuming confluence. But fisheye seems to be a different setting, is there any way to adjust header without doing some kind of reverse proxy?
While a reverse proxy would be my first choice, you might have success modifying the config.xml file. Fisheye uses Jetty for its application server (vs Tomcat for Jira and Confluence), so the setup is different than other documentation you might use for other products.
Here's some discussion around adding the stsMaxAge value into a config.xml file for Jetty:
Note that this is untested on my end. Using a reverse proxy is typically how I'd recommend terminating SSL with Fisheye.
On October 20, 2021, Atlassian published a security advisory for Jira Service Management. The full advisory is available at this link. We've seen a number of questions already asking for...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events