Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-22493

Patches for XSS / XSRF vulnerabilities

XMLWordPrintable

      We have identified and fixed vulnerabilities in JIRA 4.2 which will allow an attacker to invoke XSS (Cross Site Scripting) attacks and/or Cross Site Request Forgery (XSRF) attacks. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory 2010-11-06.

      The patches below should be applied. Please note that all Studio instances are not vulnerable at the time of this disclosure.

      Note these patches are cumulative and include the fixes that were applied in JRA-21004,

      Patches

      Version File
      3.13.5 patch-JRA-22493-3.13.5.zip
      4.0.2 patch-JRA-22493-4.0.2.zip
      4.1.2 patch-JRA-22493-4.1.2.zip
      4.2 patch-JRA22493-4.2.zip

            [JRASERVER-22493] Patches for XSS / XSRF vulnerabilities

            Bugfix Automation Bot made changes -
            Minimum Version New: 3.13
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2842463 ] New: JAC Bug Workflow v3 [ 2927128 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2576606 ] New: JAC Bug Workflow v2 [ 2842463 ]
            Ignat (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1540467 ] New: JIRA Bug Workflow w Kanban v7 - Restricted [ 2576606 ]
            Confluence Escalation Bot (Inactive) made changes -
            Labels Original: security New: affects-server security
            Oswaldo Hernandez (Inactive) made changes -
            Component/s Original: Security [Deprecated] [ 11831 ]
            Labels New: security
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 [ 679391 ] New: JIRA Bug Workflow w Kanban v6 - Restricted [ 1540467 ]
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v5 [ 661737 ] New: JIRA Bug Workflow w Kanban v6 [ 679391 ]
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v5 [ 260561 ] New: JIRA Bug Workflow w Kanban v6 [ 661737 ]

            robk added a comment -

            Running an unzip across my Jira instances is both clunky and breaks the rpm I build to deploy and manage my Jira install. I can probably wangle a %patch in the specfile, but surely it would have been just as easy to roll an updated tar.gz of the Jira standalone install bundle? This kind f ad-hoc patching is not what I'd expect of Atlassian.

            robk added a comment - Running an unzip across my Jira instances is both clunky and breaks the rpm I build to deploy and manage my Jira install. I can probably wangle a %patch in the specfile, but surely it would have been just as easy to roll an updated tar.gz of the Jira standalone install bundle? This kind f ad-hoc patching is not what I'd expect of Atlassian.

              pleschev Peter Leschev
              jwinters tier-0 grump
              Affected customers:
              0 This affects my team
              Watchers:
              14 Start watching this issue

                Created:
                Updated:
                Resolved: