Trivy vulnerabiltiy scan of atlassian/jira-software:9.11.0 image picks up critical vulnerabilities

[Saul Williamson]

Ran trivy image vulnerability scanner on atlassian/jira-software:9.11.0. It is picking up a number of critical vulnerabilities listed below.

Looking through old tickets and other documentation some of these are considered non-applicable.  But the following items are still of concern:

org.yaml:snakeyaml
CVE-2022-1471

org.eclipse.jetty:jetty-server
CVE-2017-7658
CVE-2017-7657

List of critical vulnerabilities picked up by Trivy image security scan:

Package	Vulnerability ID	Severity	Installed Version	Fixed Version
com.fasterxml.jackson.core:jackson-databind	CVE-2017-15095	CRITICAL	2.3.3	2.7.9.2, 2.8.10, 2.9.1
com.fasterxml.jackson.core:jackson-databind	CVE-2018-11307	CRITICAL	2.3.3	2.7.9.4, 2.8.11.2, 2.9.6
com.fasterxml.jackson.core:jackson-databind	CVE-2018-14718	CRITICAL	2.3.3	2.6.7.2, 2.9.7
com.fasterxml.jackson.core:jackson-databind	CVE-2018-7489	CRITICAL	2.3.3	2.7.9.3, 2.8.11.1, 2.9.5
com.fasterxml.jackson.core:jackson-databind	CVE-2019-14540	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-14893	CRITICAL	2.3.3	2.8.11.5, 2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16335	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16942	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16943	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-17267	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-17531	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-20330	CRITICAL	2.3.3	2.8.11.5, 2.9.10.2
org.eclipse.jetty:jetty-server	CVE-2017-7657	CRITICAL	8.1.15.v20140411	9.2.25.v20180606, 9.3.24.v20180605
org.eclipse.jetty:jetty-server	CVE-2017-7658	CRITICAL	8.1.15.v20140411	9.2.26.v20180806, 9.3.24.v20180605, 9.4.11.v20180605
org.springframework:spring-web	CVE-2016-1000027	CRITICAL	5.3.26	6.0.0
org.yaml:snakeyaml	CVE-2022-1471	CRITICAL	1.19	2

[Alexey Matveev]

Hello,

You would need an add-on for it.

For example, you could use the Power Scripts add-on:

https://marketplace.atlassian.com/apps/43318/power-scripts-jira-script-automation?hosting=cloud&tab=overview

You could write a script like this:

string jql;
jql = "project = TEST";
string[] keys = selectIssues(jql);
for(string key in keys){
 string [] h = fieldHistory(%key%, "assignee");
 if (size(h) > 0) {
   date changeDate = parseDate("dd.MM.yyyy", h[0]);
   interval diff = currentDate() - changeDate;
   if (diff >= "3d") {
     %key%.assignee = "";
   }
 }
}

Then you can schedule this script with the runJobByCron method:

https://confluence.cprime.io/display/SIL/runJobByCron

[Joe Pitt]

From historical experience unassigned issues don't get worked

[Arnold Roa]

well.. our tickets takes 20 minutes to do, if someone assigns a ticket and end his shift without anyone work on it until the next day when his shift starts.

We offer 24/7 service, our people do what is unassigned all the time.

So it's a different context.