The bin installer of Jira server 8.19 is using the JDK11.0.11, and is affected by the below vulnerability
Based on 20 Jul 21 OpenJDK advisory,
The following vulnerabilities in OpenJDK source code were fixed in this release. The affected versions are 16.0.1, 15.0.3, 13.0.7, 11.0.11, 8u292, 7u301, and earlier. Please note that defense-in-depth issues are not assigned CVEs. We recommend that you upgrade as soon as possible.
I have installed on-prem using the Jira 8.19 bin installer
Not sure if 8.19.1 has fixed this?
I didn't find a reference to this fix in the release notes:
I was also looking for a reference in the Atlasian Jira project that tracks fixes but didn't find CVE-2021-2388 :
I like to ask on the workaround,
Install/download the version of Java required by JIRA (see Supported Platforms); - Install OpenJDK 11 RHEL rpm , is that OK?
Set the path where you installed Java as the JAVA_HOME (JDK) or JRE_HOME (JRE) variables for JIRA (see instructions below);
Note: If JRE_HOME is not defined, Jira will define its value using the JAVA_HOME value
Go to the location where you installed JIRA, then to the bin folder;
Edit the setenv.sh file and add the line at the initial lines:
Set PATH to include the <Java>/bin folder
After that the bin installer, should use the rpm OpenJDK instead of the bin installer AdoptOpenJDK?
i am using the bin installer and I tried to change the JAVA_HOME last time but didnt work.
This was the last error faced:
if [ $java_version -ne 8] && [ $java_version -ne 11]
I am using:
OpenJDK Runtime Environment 18.9 (build 11.0.12+7-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.12+7-LTS, mixed mode, sharing)
I have updated to 8.21.1 and it's still using OpenJDK 11.0.11. In this link, https://jira.atlassian.com/browse/JRASERVER-72880?jql=text%20~%20CVE-2021-2388
it mentions that it was fixed in 8.20.4?
Any plans to fix this?
👋 Hi there Jira Community! A few months ago we shared with you plans around renaming epics in your company-managed projects. As part of these changes, we highlighted upcoming changes to epics on...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events