Security Bulletin Updates for February 2024 - Seeking your feedback!
Hey everyone, I'm Lee, a Product Manager in the Security department here at Atlassian. I wanted to let you know that we've made a few updates to the format of our security bulletins as a first step to address the heightened volume of support tickets and questions ("Is my version affected?") that we regularly receive regarding our security bulletins. I'm also here to let you know that we are actively seeking feedback from the community for these bulletin updates and the various security resources Atlassian provides.
First, let's review the notable updates this month's Security Bulletin:
- Grouped By Product - The new bulletin table is organized by product, allowing you to locate information relevant to the Atlassian Product(s) you are using as quickly as possible.
- Full Range of Affected Versions We have included a complete list of affected product versions, being sure to include all product versions listed as supported according to our Atlassian Support End of Life Policy Page. While this is quite verbose, our primary goal is answer the "Am I affected" question.
- Comprehensive Fixed Versions The table shows each product's fixed versions for all the security vulnerabilities that affected the product in that particular bulletin. Patching to one of these versions will resolve all the vulnerabilities listed for the product in the bulletin.
- Additional Jira Ticket Details For the published Public Security Vulnerability tickets on Jira.Atlassian.com, as part of this bulletin, we have published a detailed Affected & Fixed Version table specific to the individual vulnerability. When referencing details via these Security Jira tickets - This table can answer questions regarding whether your version is affected for the Product and CVE specified on the ticket by finding your version in the "Affected versions" column and then checking the associated "Fixed versions" in the right column.
We believe these enhancements will make it easier to quickly identify the impact of vulnerabilities and take appropriate action to secure your systems without needing to file a support ticket to answer your security bulletin-related questions.
We look to take an iterative approach based on feedback to improve our bulletins, advisories, and the various security resources Atlassian provides. I would appreciate any feedback you might have for us, feel free to reach out! Thank you, I'm looking forward to working with this community!
14 comments
I just gave the portal a look and I did manage to get a result for Confluence Data Center and 7.19.18 - I did notice the drop down was not populated and I had to "Manually enter" this version.
The Portal/API does only start retrieving new data after we publish our advisory artifacts so sometimes there can be a delay between the portal having data and our bulletins going live but this should never exceed one hour.
Do you happen to know exactly when you tried using the portal? I'd like to have my engineering team investigate to see if there was an error on our api log for the time window you tried to lookup this data. Thank you!
Hello @Lee Berg ,
I think there is a mistake on Jira 9.4.15. My understanding of the bulletin is that it should be clear from any vulnerability and instead of that the vulnerability portal shows it affected by even more vulnerabilities than 9.4.14.
PS: It would be really great if you could ensure all available release appears in the "Affected versions" field.
There seems to be some inconsistency between the Vulnerability Disclosure Portal and the Security Bulletin. This ambiguity creates confusion and can lead to vulnerable systems not being patched.
Here is an example where we could potentially miss out on security vulnerabilities because of issues with the Vulnerability Disclosure Portal.
On 21st of February I checked the Vulnerability Disclosure Portal to see if our instance of Confluence had any vulnerabilities. We were running Confluence Data Center 7.19.18. At the time I could not see this version in the list at all, so I assumed there were no vulnerabilities for this version. Here is a screenshot:
However, upon reading the February 2024 Security Bulletin the following vulnerabilities were listed for Confluence Data Center 7.19.18.
CVE-2024-21678, CVE-2023-5072, CVE-2023-6481, CVE-2023-6378, CVE-2023-46589, CVE-2023-39410, CVE-2023-41835, CVE-2023-2976
The bulletin specifically mentions affected versions "from 7.19.0 (LTS) to 7.19.18 (LTS)". I assume that also means including 7.19.18 or am I wrong? Again, this wording creates ambiguity. Here is a screenshot:
As you can see there seems to be some inconsistency between the Vulnerability Disclosure Portal and the Security Bulletin.
In my opinion the reason why people are confused about which version is affected is because:
1. Atlassian has many different ways of writing (wording) which products are affected instead of adhering to one standard for how these things should be written.
2. Multiple sources of truth. Jira bug tracker, security bulletins, vulnerability portal, CVE listings. This creates confusion whenever there are contradicting information.
Can we trust the Vulnerability Disclosure Portal? If not, what is the point of having it?
