A vulnerability CVE-2017-15095 exists in the Jackson JSON library versions prior to 2.9.2. The recommended solution has been made to upgrade to Jackson 2.9.3.
We are currently running Jira v7.4.3#74005
Here are some of the .jar files that have been pointed out as needed to be remediation.
I'm looking for remediation steps for CVE-2017-15095 but has been unsuccessful in finding any.
Take a look at the Atlassian Security Advisories page. Since Jira itself is not using the affected Struts component Jira is not affected by this vulnerability outlined in CVE-2017-15095 on Apache Struts.
Let us know if you have any remaining questions.
Thank you for the quick response Branden. Would removing these .jar files still allow for JIRA to function without issue for the end user?
JIRA was already installed on the server so I'm not really familiar with the ins and outs of it. I'm just trying to gather a greater understanding.
Badges are a great way to show off community activity, whether you’re a newbie or a Champion.Learn more
Hi Atlassian Community! My name is Shana, and I’m on the Jira Software team. One of the many reasons this Community exists is to connect you to others on similar product journeys or with comparabl...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG