Make use of Secure Introspector in Velocity Templates - CVE-2019-20409

Atlassian Update – 05 October 2020 Hi everyone, thank you for all your comments and questions. We would like to inform you that we have been investigating the possibility of backporting the requested functionality to Jira LTS versions 7.13x and 8.5.x. Unfortunately this improvement causes problems with non-Atlassian plugins preventing them from working correctly. Due to its technical complexity we cannot provide any means of disabling it without manipulation with Jira files. We treat this issue as a security improvement, not a security vulnerability that can be exploited. We have made it harder for an attacker to exploit potential server-side template injection vulnerabilities in the future Jira releases. In the light of the above, we have decided not to backport the requested functionality to both Jira 8.5.x and 7.13.x LTS releases. We understand that this decision may be disappointing, however we want to assure you that we will keep treating all server-side template injection vulnerabilities as high or critical severity issues if they affect our LTS releases. For those customers who are currently using our LTS versions, we have prepared a workaround (please see the description field of this issue). After applying the workaround all native Jira functionality should work as before, however some 3rd party and your own internal apps may stop working or cause problems with other Jira functionality. You can use this workaround at your own discretion. The security improvement will be available in our upcoming 8.13 LTS release. If you have any questions or feedback about the workaround, please leave us a comment. Kind regards, Paweł Przytarski Jira Server Bugfix Team