upgrade regarding Fisheye and Crucible Security Advisory 2014-05-21

[Didier Riedinger]

Hello,

Currently Fisheye and Crucible 3.1.3 are installed on our server with a 10 users license. Which Fisheye and Crucible version shall I install/upgrade to fix the vulnerability "Fisheye and Crucible Security Advisory 2014-05-21"? What are the detailed steps to follow for the upgrade (we have only a production instance of Fisheye/Crucible)?

I'm only the administrator of Fisheye/Crucible/Jira. Do I need super user permission on the server for the upgrade?

Thank you in advance.

Best regards.

Didier RIEDINGER.

[PeterP · Accepted solution]

The advisory and your answer is confusing. The advisory states that 3.x is affected then says 3.0.4 is OK and 3.1.7... etc. It is *unclear* that you maintain releases of 3.0.x, 3.1.x 3.2.x 3.3.x and 3.4.x ... and that you're asking people to upgrade within those release sets!

It would be much simpler to just say upgrade to the latest version 3.4.4 which would have the benefit of getting your customers onto the latest version.

IMHO that is just version management madness :-)

Peter McNeil.

[Nick]

Hi Peter,

Any version later than 3.x was affected, until we released the fix versions of course.

These are released in case some users don't wish to upgrade to a major point release. In that case, they can upgrade to the latest minor point release, which we've just done. The following releases are all safe to upgrade to 3.0.4, 3.1.7, 3.2.5, 3.3.4, 3.4.4, and if you are running a version less than these, we advise you upgrade.

Cheers,

Nick

[Fabio Racobaldo _Herzum_]

Hello Didier,

you should upgrade your Fisheye/Crucible to one of these version 3.0.4, 3.1.7, 3.2.5, 3.3.4, 3.4.4.

Here the documentation you need for the upgrade guide https://confluence.atlassian.com/display/FISHEYE/FishEye+upgrade+guide

Hope this helps,

Fabio