Trivy vulnerabiltiy scan of atlassian/jira-software:9.11.0 image picks up critical vulnerabilities

[Saul Williamson]

Ran trivy image vulnerability scanner on atlassian/jira-software:9.11.0. It is picking up a number of critical vulnerabilities listed below.

Looking through old tickets and other documentation some of these are considered non-applicable.  But the following items are still of concern:

org.yaml:snakeyaml
CVE-2022-1471

org.eclipse.jetty:jetty-server
CVE-2017-7658
CVE-2017-7657

List of critical vulnerabilities picked up by Trivy image security scan:

Package	Vulnerability ID	Severity	Installed Version	Fixed Version
com.fasterxml.jackson.core:jackson-databind	CVE-2017-15095	CRITICAL	2.3.3	2.7.9.2, 2.8.10, 2.9.1
com.fasterxml.jackson.core:jackson-databind	CVE-2018-11307	CRITICAL	2.3.3	2.7.9.4, 2.8.11.2, 2.9.6
com.fasterxml.jackson.core:jackson-databind	CVE-2018-14718	CRITICAL	2.3.3	2.6.7.2, 2.9.7
com.fasterxml.jackson.core:jackson-databind	CVE-2018-7489	CRITICAL	2.3.3	2.7.9.3, 2.8.11.1, 2.9.5
com.fasterxml.jackson.core:jackson-databind	CVE-2019-14540	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-14893	CRITICAL	2.3.3	2.8.11.5, 2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16335	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16942	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-16943	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-17267	CRITICAL	2.3.3	2.9.10
com.fasterxml.jackson.core:jackson-databind	CVE-2019-17531	CRITICAL	2.3.3	2.9.10.1
com.fasterxml.jackson.core:jackson-databind	CVE-2019-20330	CRITICAL	2.3.3	2.8.11.5, 2.9.10.2
org.eclipse.jetty:jetty-server	CVE-2017-7657	CRITICAL	8.1.15.v20140411	9.2.25.v20180606, 9.3.24.v20180605
org.eclipse.jetty:jetty-server	CVE-2017-7658	CRITICAL	8.1.15.v20140411	9.2.26.v20180806, 9.3.24.v20180605, 9.4.11.v20180605
org.springframework:spring-web	CVE-2016-1000027	CRITICAL	5.3.26	6.0.0
org.yaml:snakeyaml	CVE-2022-1471	CRITICAL	1.19	2

[Ismael Jimoh]

Hi,

try spint was ‘value of old sprint’

that should help. Note though that if an issue was ever in the sprint you mentioned then it’ll also be listed.

[Ismael Jimoh]

Sorry there is no JQL operation to filter for sprint was

[jrii]

ok, thanks from your effort still.