JIRA Service Desk 4.2.2 affected by the latest Security Vulnerabilities Oct 23?

[Jaya]

Hello Everyone...I'm new to Jira :D ..currently in my environment there is Jira Service Desk 4.2.2 installed. Does this version part of CVE's impacted from the Oct 23 releases? 

Security Bulletin - October 17 2023 | Atlassian Support | Atlassian Documentation

Notice Jira Service Management Data Center and Server were impacted however the affected version seems to be above 4.20.0 

[Marc Koppelaar - Devoteam · Accepted solution]

Hi @Jaya 

This link is showing all security advisories and realted issues.

This security advisory is related to you and yes you are impacted and will need to mitigate.

Also at the end of the page you will find the minimum requirements where you would need to upgrade to

Jira Service Management Data Center and Server

Upgrade to a minimum fix version of 4.20.27, 5.4.11 or latest

[Jaya]

Hi @Marc Koppelaar - Devoteam  thanks for the prompt response.  one quest is it okay to upgrade it to 4.20.27 without upgrading Jira Software? any impact?  or is it both require to be on same exact version? 

Jira applications compatibility matrix | Atlassian Support | Atlassian Documentation

[Marc Koppelaar - Devoteam]

Hi @Jaya 

If both products run in the same backend DB (so together in a Jira setup), upgrade Jira Software first and Jira Service Management after.

See doc's here